Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

The ownCloud graphapi app versions 0.2.0 through 0.3.0 are affected when the GetPhpInfo.php test file is present. The fix is in graphapi 0.2.1 and 0.3.1, and no vendor severity rating is given.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
None on Exploit-DB, Metasploit or GitHub

Summary

The ownCloud graphapi app (versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1) is affected. A bundled third-party file publicly exposes the server's PHP configuration details, which can reveal sensitive information such as environment variables, and in containerized deployments may expose credentials like the admin password, mail server login, and license key.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • n/a n/a

    Version range not reported

References 2

owncloud.org

owncloud.com

FAQ

Questions about CVE-2023-49103

What does this mean?

Requesting the GetPhpInfo.php URL reveals the PHP configuration (phpinfo), including all webserver environment variables. In containerized deployments these can include the ownCloud admin password, mail server credentials, and license key, and other sensitive system configuration may also be exposed.Source: owncloud.com, owncloud.com

Am I affected, and how do I check?

The affected range is graphapi 0.2.0 through 0.3.0, and only when the graphapi app is installed with GetPhpInfo.php present in owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/. Docker containers created before February 2023 are not vulnerable to the credential disclosure. To check, look for that file in the app's vendor tests directory and confirm the installed graphapi version.Source: owncloud.com, owncloud.com

What should I do about it?

Upgrade graphapi to 0.2.1 for the 0.2.x line or 0.3.1 for the 0.3.x line. Where the file is present, deleting it also removes the exposure.Source: owncloud.com, owncloud.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-11-30, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data

What if there's no patch?

Delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php. The advisory also states that the phpinfo function was disabled in their Docker containers.Source: owncloud.com, owncloud.com