CVE-2023-49103
ownCloud ownCloud graphapi — ownCloud graphapi Information Disclosure Vulnerability
Description
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2023-49103 scores CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:H) — the endpoint requires zero authentication and, in containerised deployments, returns the ownCloud admin password, mail credentials, and license key in a single unauthenticated HTTP GET. The EPSS score of 78 % at the 99.6th percentile reflects how trivially this is exploited: no tooling, no authentication, no interaction required. For NIS2-scoped organisations running ownCloud as a collaboration platform for sensitive or regulated data, the blast radius is a full tenant takeover. Although CISA has not flagged confirmed ransomware use, the credential-disclosure nature of the vulnerability makes it a natural precursor to lateral movement and data exfiltration. Treat this as critical priority: patch and credential rotation must complete before any other remediation work, as every hour of exposure is an open door to complete ownCloud compromise.
Runbook · Step 1
Immediate response (0-24 h)
- Apply patches immediately: Update graphapi to 0.3.1 (or 0.2.1 for the 0.2.x branch), ownCloud Core to 10.13.1, and the oauth2 app to 0.6.1. All three components must be updated together.
- Delete the vulnerable file manually: Remove
owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.phpfrom the filesystem. Disabling the graphapi app alone does NOT remove the file — it remains HTTP-accessible until deleted. - Rotate all exposed credentials immediately: Reset the ownCloud admin password, mail server credentials, license key, and any other secrets set as container environment variables. This is mandatory for Docker images built after February 2023.
- Block the endpoint at the perimeter: Configure your reverse proxy or WAF to return HTTP 403 for the path
/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.phpas an emergency control until the patch is deployed. - Audit container environment variables: Identify every secret stored as an ENV variable in the container image or
docker-compose.yml/ Kubernetes manifest; migrate secrets to a vault (e.g. HashiCorp Vault, Azure Key Vault) and remove plaintext credentials from image definitions. - Review historical access logs: Search web server and CDN logs for GET requests to the vulnerable path from the container start date onward. Any HTTP 200 response to that endpoint is a confirmed indicator of exposure.
Runbook · Step 2
Mitigation layers
- WAF/reverse-proxy block: Add an Nginx
locationblock or Apache<Location>directive withdeny all/return 403for the exact pathGetPhpInfo.php; alternatively a ModSecurity rule matchingREQUEST_URI "@contains GetPhpInfo.php". - Network segmentation: ownCloud instances must only be reachable from the internet via a hardened reverse proxy. Block direct access to the application port (default TCP 8080 / 443) from untrusted networks at the firewall level.
- Least-privilege secrets management: Remove credentials from container image ENV layers; use Kubernetes Secrets with
readOnlyvolume mounts or an external secret manager. No plaintext passwords indocker-compose.yml. - Disable phpinfo() globally: Set
disable_functions = phpinfoinphp.iniwhere the application does not require it — reduces attack surface for this and similar future vulnerabilities. - Disable the graphapi app (supplementary only): Disable the app via the ownCloud admin UI as an additional layer, but do not treat this as sufficient — the vulnerable file persists on disk until manually deleted or patched.
Runbook · Step 3
Detection rules
- Web server access log (Apache/Nginx): Alert on
GET.*GetPhpInfo\.phpreturning HTTP 200. SPL:index=webserver sourcetype=access_combined uri="*GetPhpInfo.php" status=200 - Suricata/Snort network signature:
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2023-49103 ownCloud phpinfo disclosure attempt"; content:"GetPhpInfo.php"; http_uri; sid:2023491030; rev:1;) - Sigma rule shape (web log source):
detection: keywords: - 'GetPhpInfo.php'combined withhttp.status: 200andhttp.method: GET; data source: web server access log ingested via Filebeat or equivalent. - Container/network layer (Zeek): Unexpected outbound connections from the ownCloud container to external IPs following a hit on the endpoint may indicate post-exploitation activity —
conn.log | where id.orig_h == <owncloud_ip> AND NOT id.resp_h IN <allowlist>. - Credential-reuse monitoring: Failed authentication attempts using the old admin password after rotation — visible in
owncloud.logor the upstream IdP (LDAP/SAML) — indicate an attacker is actively using already-exfiltrated credentials.
Metrics
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
ownCloud
ownCloud< 10.13.1
fixed in 10.13.1
ownCloud
ownCloud<graphapi 0.3.1
ownCloud
ownCloud<oauth2 0.6.1
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.