ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation | Ars Technica
“The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL”
OwnedCloud.
Thank you, thank you.
Honestly, all applications are vulnerable AF, especially the open source projects without a major team behind them. I work in a security research team and we find critical bugs like this in a weekly basis. Even in major projects which you would be scared to know about. I personally wouldn’t expose anything except SSH or a VPN, or if I have to expose a web app, it’s going inside a VLAN with very restrictive firewall rules, proper logging, and a reverse proxy enforcing authentication via an OIDC based IDP.
We generally spend a couple of days to a week before finding something critical allowing RCE.
This is why I don’t expose anything other than my wireguard on my network
Also worth noting here: Exposing wireguard is quite safe because the daemon doesn’t even respond unless it recognizes your key. It just drops the UDP packet otherwise.
Nothing is unhackable, but this is damn near close. Such a brilliant design.
Oof size: LARGE.
Oof size: 10 (maximum oof size)
Yes hello, I’d like to biggie size my oof
Does this pertain to Nextcloud as well??
That’s why I keep nextcloud behind http basic auth. Don’t trust those software to expose them directly to Internet.
Basic auth is better than no auth, but it is absolutely not a recommended auth method these days
I use it on top of nextcloud auth
Basic auth is a base64 of your login credentials, might as well be plain text. You should absolutely not be using basic auth if you have other options
Like Authelia?
This would prevent nextcloud sync and phone apps from proper access wouldn’t it?
Ist this also affecting ownCloud OCIS as well?
To my understanding, OCIS is a complete rewrite of OwnCloud and was written in Go. So my intuition tells me it’s not but I could be wrong.
As article states, you’re not vulnerable if you don’t have the ‘graphapi’ app installed, whatever that is. Checked my nextcloud instance and it’s not there.
I can’t stress this enough, keep your private and enterprise cloud behind a vpn. Especially if you are a part time Admin with limited resources. Sooner or later you will be hacked.
So like a wireguard and Authelia?
POST /api/admin/unauthorized_sudoOh, no, it’s PhpGetInfo.php, sorry, my bad.
I’m surprised that ownCloud didn’t use a single PHP entrypoint. In PHP software you must restrict access to .php files, that’s front controller basis. They really did bad and I’m very disappointed.
Thanks, OP. Now if only I could figure out how to change the SQLite database password in ownCloud 10.10 (it’s not stored in config.php, but there is a “passwordsalt” configured there).
Might be wise to use Authelia in front of any web apps as an extra layer.
Does this affect Nextcloud?
