Top file-sharing service hit with embarrassing security bug that reveals admin passwords

An abstract image of a cloud raining data.
(Image credit: Pixabay)

Top file sharing service ownCloud has released three fixes to critical vulnerabilities that allowed malicious actors to steal admin credentials, modify and delete files at will, and redirect callbacks.

ownCloud is an open-source file-syncing and sharing software for businesses who would rather store files in their own servers, instead of a third-party environment. Per its site, it services more than 200 million users worldwide. 

As it consists of multiple libraries, the vulnerabilities discovered were found in different components. The first one, CVE-2023-49103, can be abused to steal login data and configuration information in containerized deployments. This flaw was given the maximum severity score - 10.

Reader Offer: $50 Amazon gift card with demo

Reader Offer: $50 Amazon gift card with demo
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner (What does this mean?

Applying the fixes

The second flaw allows threat actors to bypass authentication and thus access, modify, and delete files found on the servers. All the attackers need is a username of a user that kept the default settings for the signing-key. This flaw was given a rating of 9.8.

The third is the least severe of all, with a severity score of 9. This vulnerability is a subdomain validation bypass that hackers can abuse by creating a unique URL that bypasses the validation code. As a result, the hackers can redirect callbacks to a domain controlled by the attacker. 

All three vulnerabilities have different mitigation methods, so users are advised to read the details here, here, and here. They are also advised not to delay in applying these fixes, as the flaws severely impact the security and integrity of the ownCloud platform. 

Hackers can abuse it steal data, engage in identity theft and phishing, and more. The problem is all the more pressing considering that recently, other prominent file sharing services, most notably GoAnywhere and MOVEit, were breached, leading to thousands of firms having their sensitive data compromised or stolen. 

Via BleepingComputer

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.