CVE-2023-49105
ownCloud Improper Authentication Vulnerability
Description
CVE-2023-49105 is a critical improper authentication vulnerability in ownCloud core that allows an attacker to access, modify or delete any file without authentication, provided the victim's username is known and the victim has no signing key configured. The defect is that pre-signed URLs are accepted through the WebDAV API even when no signing key exists for the owner of the files, so the signature check that is supposed to prove authorisation has nothing to verify against and passes anyway. ownCloud core before 10.13.1 is affected, with 10.6.0 the earliest affected version. With a CVSS score of 9.8, an EPSS score of roughly 43% at the 98th percentile and documented use by a state-aligned operator, CVE-2023-49105 remains one of the most heavily exploited file-sharing vulnerabilities and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog with a deadline of 30 August 2026.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| owncloud | owncloud server | >= 10.6.0, < 10.13.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/(Vendor Advisory)
- https://owncloud.org/security(Product)
- https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
Improper authentication occurs when an actor claims an identity and the software does not prove, or insufficiently proves, that the claim is correct. In CVE-2023-49105 ownCloud's WebDAV API accepts pre-signed URLs as proof of authorisation, but when the file owner has no signing key configured the validation cannot meaningfully verify the signature and the request is admitted regardless — an unauthenticated attacker who knows a username is therefore treated as that user for file operations.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2023-49105 is remotely exploitable over the network with low attack complexity, no authentication and no user interaction — the attacker needs only the victim's username, which in most ownCloud deployments is an email address or a predictable directory identifier rather than a secret. The impact is high across confidentiality, integrity and availability, because the attacker can access, modify and delete any of that user's files: every document stored in the account can be exfiltrated, silently altered, or destroyed. For an organisation running ownCloud as its file-sharing platform, that means exposure of contracts, personnel records and internal documentation, and a plausible path to ransomware-style destruction without any malware being deployed. The narrow-sounding precondition — the victim has no signing key configured — is in practice the default state for many accounts, which is why the vulnerability is so widely exploitable. The EPSS score of approximately 43% in the 98th percentile is among the highest assigned to any tracked vulnerability, and CISA's KEV listing confirms exploitation in the wild.
Exploit Maturity
CVE-2023-49105 is among the most thoroughly exploited vulnerabilities currently tracked. CISA has confirmed active exploitation through its Known Exploited Vulnerabilities listing, with a remediation deadline of 30 August 2026 that has already passed. The EPSS score of roughly 43%, in the 98th percentile, is exceptionally high and reflects sustained mass exploitation — a level of activity consistent with this vulnerability having been publicly known since 2023 and requiring nothing more than a known username to exploit. Beyond opportunistic attacks, threat intelligence from Hunt.io documents a Chinese-speaking operator targeting a Philippine nuclear and naval contractor, evidencing use in targeted espionage as well. No packaged exploit tool appears among the references, but none is needed: the technique is a crafted HTTP request, and the vendor advisory describes the condition precisely. Any ownCloud instance still below 10.13.1 should be assumed compromised.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with ownCloud's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 30 August 2026 has passed.
- Upgrade ownCloud core to 10.13.1 or later. Versions from 10.6.0 up to 10.13.1 are affected; ownCloud documents the flaw in its advisory on WebDAV API authentication bypass using pre-signed URLs. Given the age of this vulnerability, instances still running an affected build are likely far behind on other security fixes too and should be moved to a currently supported release.
- Restrict access to the ownCloud instance while patching. Place the service behind a VPN or IP allowlist and, where feasible, block WebDAV endpoints from untrusted networks — because exploitation needs only a username and network reach, removing internet exposure is the only effective interim control.
- Assume file compromise and investigate thoroughly. Review WebDAV access logs for requests carrying pre-signed URL parameters from unfamiliar addresses, correlate them with file read, write and delete operations, and check file version history and trash for unexplained modifications or deletions. Threat intelligence published by Hunt.io on a Chinese-speaking operator targeting a Philippine nuclear and naval contractor documents this vulnerability's use in espionage activity, so treat any anomaly as potentially targeted rather than opportunistic.
- Restore integrity and harden authentication long term. Restore affected files from backups taken before the exposure window, reset user credentials and revoke existing sessions and app passwords, and ensure signing keys are configured for all accounts; then adopt the general defences for improper authentication — use well-tested authentication frameworks rather than bespoke signature logic, fail closed when a verification prerequisite such as a key is missing, and require multi-factor authentication for the web interface.
Technical Details
CVE-2023-49105 is an improper authentication flaw (CWE-287) in the ownCloud WebDAV API. ownCloud supports pre-signed URLs, a mechanism in which a URL carries a cryptographic signature produced with the file owner's signing key so that the server can grant access without an interactive login. The defect is in how the server behaves when that key does not exist: instead of rejecting the request because the prerequisite for verification is absent, versions before 10.13.1 accept the pre-signed URL anyway. An attacker who knows a target username can therefore craft a request against that user's files and have it honoured, gaining full read, write and delete access to their storage. This is the archetypal fail-open error — the authentication logic is bypassed not by defeating the signature, but by removing the condition under which a signature is checked at all. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H records an unauthenticated, low-complexity network attack with no user interaction and complete impact on confidentiality, integrity and availability at unchanged scope.
Frequently Asked Questions
Is CVE-2023-49105 being actively exploited?
Yes, extensively. CISA lists CVE-2023-49105 in its Known Exploited Vulnerabilities catalog with a remediation deadline of 30 August 2026 that has passed, and its EPSS score of about 43% places it in the 98th percentile — one of the highest exploitation probabilities assigned to any vulnerability. Published threat intelligence also documents its use by a state-aligned operator against a defence-sector contractor.
What products are affected by CVE-2023-49105?
ownCloud Server (owncloud/core) is affected from version 10.6.0 up to but excluding 10.13.1. The exposure applies to accounts whose owner has no signing key configured, which is a common default state, and the vulnerable interface is the WebDAV API.
How do I fix CVE-2023-49105?
Upgrade ownCloud core to 10.13.1 or later — and preferably to a currently supported release, given how long this flaw has been public. Restrict network access to the instance in the interim, then audit WebDAV logs and file version history for unauthorised access, modification or deletion, reset user credentials and sessions, and restore any affected files from clean backups.
How severe is CVE-2023-49105?
CVE-2023-49105 is Critical with a CVSS 3.1 base score of 9.8. It is unauthenticated, network-exploitable with low complexity and no user interaction, and allows an attacker who merely knows a username to read, modify and delete all of that user's files — full confidentiality, integrity and availability impact; with an EPSS score in the 98th percentile and confirmed exploitation by both opportunistic and state-aligned attackers, it is among the most urgent outstanding patches.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.