CVE-2023-49103
ownCloud graphapi Information Disclosure Vulnerability
Description
CVE-2023-49103 is a CRITICAL information disclosure vulnerability in the ownCloud graphapi application, receiving the maximum CVSS score of 10.0. The flaw arises from the graphapi app's reliance on a third-party PHP library (GetPhpInfo.php) that exposes a URL revealing full PHP environment configuration details via phpinfo(). In containerized deployments, this can expose highly sensitive data including the ownCloud admin password, mail server credentials, and license keys — all without any authentication. The vulnerability is unauthenticated, remotely exploitable, requires no user interaction, and impacts confidentiality, integrity, and availability at the highest level, with scope changed (S:C) indicating impact beyond the vulnerable component itself.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| owncloud | graph api | 0.2.0; 0.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, a weakness where software inadvertently exposes sensitive information to parties who are not authorized to access it. In CVE-2023-49103, the GetPhpInfo.php library bundled with the graphapi app creates a web-accessible endpoint that outputs the complete output of PHP's phpinfo() function. This built-in PHP diagnostic function dumps all environment variables, configuration settings, loaded extensions, and server information. The fundamental weakness is the inclusion of diagnostic tooling in a production-facing application without access controls, combined with containerized environments that inject secrets directly into environment variables accessible to phpinfo().
Impact Analysis
CVE-2023-49103 carries a perfect CVSS score of 10.0 and a Changed scope, reflecting that a successful attack extends impact well beyond the ownCloud instance itself. When containerized deployments expose environment variables via phpinfo(), an unauthenticated attacker can harvest admin credentials, mail server passwords, API keys, and license keys in a single unauthenticated HTTP request. With admin credentials, an attacker achieves complete control over the ownCloud instance — enabling access to all stored files, user data, and the ability to pivot to connected systems. The attack requires no privileges, no user interaction, and no complexity on the attacker's part — simply accessing the exposed URL is sufficient. The EPSS score of 0.94329 (99.95th percentile) reflects near-certain exploitation in the wild, and this vulnerability was rapidly weaponized after public disclosure with mass internet scanning observed within days.
Exploit Maturity
CVE-2023-49103 achieved an EPSS score of 0.94329 (99.95th percentile), placing it among the most likely-to-be-exploited vulnerabilities across the entire CVE catalog. The vulnerability's simplicity — a single unauthenticated HTTP GET request to a predictable URL path — made it trivially exploitable and mass-scanned within days of disclosure in November 2023. CISA added it to the KEV catalog with a December 21, 2023 deadline, confirming active exploitation. The combination of a perfect CVSS score, near-universal EPSS ranking, and unauthenticated network access with zero complexity makes this one of the most practically dangerous vulnerabilities disclosed in 2023. Organizations running ownCloud in containerized environments should treat exposure as a confirmed compromise requiring immediate credential rotation.
Remediation
- Delete the vulnerable file: Remove the file
owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.phpfrom all ownCloud installations. This eliminates the exposed endpoint. - Disable phpinfo() in PHP configuration: Set
disable_functions = phpinfoin yourphp.inito prevent PHP from outputting environment information even if similar files exist. - Rotate all exposed credentials immediately: Assume that any ownCloud admin password, mail server credentials, license keys, and other secrets present in environment variables have been compromised. Rotate all credentials immediately regardless of whether exploitation is confirmed.
- Update graphapi app: Upgrade the ownCloud graphapi app to version 0.2.1 or 0.3.1, which remove the vulnerable library.
- Follow the official ownCloud security advisory: Apply all mitigations described at https://owncloud.com/security-advisories/ in full — simply disabling the graphapi app does not remove the vulnerable file and is insufficient as a standalone mitigation.
- Audit Docker container configurations: Review environment variable injection practices and avoid passing secrets via environment variables where possible; prefer secret management solutions (Vault, Kubernetes Secrets with encryption at rest).
- Scan for exploitation: Review web server access logs for requests to the
GetPhpInfo.phpendpoint to determine if exploitation occurred prior to remediation.
Technical Details
CVE-2023-49103 arises from a design flaw in the ownCloud graphapi application (versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1). The graphapi app depends on the Microsoft Graph PHP SDK, which includes a test utility file GetPhpInfo.php that was inadvertently bundled into the production package. This file contains code that calls PHP's built-in phpinfo() function and outputs the results when accessed via HTTP — with no authentication check. In containerized Docker deployments (a common ownCloud deployment pattern), application secrets such as OWNCLOUD_ADMIN_PASSWORD, SMTP_PASSWORD, and OWNCLOUD_LICENSE_KEY are typically injected as environment variables. PHP's phpinfo() outputs all environment variables in its response, making these secrets directly readable by any unauthenticated actor who accesses the endpoint. The CVSSv3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects the complete absence of exploitation prerequisites. Docker containers created before February 2023 are not vulnerable to credential disclosure because ownCloud changed its container secret injection mechanism at that time; however, phpinfo exposure of other sensitive configuration details remains a concern for all affected versions.
Frequently Asked Questions
Which ownCloud deployments are most at risk from CVE-2023-49103?
ownCloud deployments using Docker containers created after February 2023 face the highest risk, as these containers inject secrets (admin password, mail credentials, license key) as environment variables that are exposed by phpinfo(). On-premises deployments without containerization are still vulnerable to phpinfo disclosure of PHP configuration details, but may not expose the same level of credential data.
Is it enough to disable the graphapi app to fix CVE-2023-49103?
No. ownCloud explicitly stated that disabling the graphapi app does not eliminate the vulnerability, because the vulnerable GetPhpInfo.php file may remain on the filesystem and accessible via the web server even with the app disabled. The vulnerable file must be explicitly deleted, and the graphapi app must be updated to a fixed version (0.2.1 or 0.3.1).
Should I assume my credentials were stolen if I ran a vulnerable version?
Given the EPSS score of 0.94329 (99.95th percentile) and mass scanning observed shortly after disclosure, organizations that ran vulnerable ownCloud containers exposed to the internet should assume credential exposure. Rotating all secrets stored in container environment variables — admin passwords, mail credentials, API keys, and license keys — is strongly recommended regardless of confirmed exploitation.
How can I check if the vulnerable endpoint was accessed on my system?
Search web server access logs for requests containing GetPhpInfo.php or graphapi/vendor/microsoft/microsoft-graph/tests/. Any GET requests to this path from external IP addresses indicate potential exploitation. Use log analysis tools or SIEM systems to correlate these requests with source IPs and timestamps.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.