CVE-2023-49105: ownCloud Flaw Exploited to Steal Nuclear Research Data

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical ownCloud vulnerability, CVE-2023-49105, to its Known Exploited Vulnerabilities (KEV) catalog on Thursday, following reports that a Chinese-speaking threat actor exploited the flaw to steal nuclear research records from a Philippine government agency. The vulnerability, which carries a CVSS score of 9.8, allows unauthenticated attackers to access sensitive data through a crafted request to the ownCloud WebDAV endpoint. This is the first known incident where CVE-2023-49105 has been tied to a state-aligned actor targeting critical research infrastructure.

Defenders should treat this as an active threat: the KEV addition confirms real-world exploitation, and the target profile—a nuclear research body—suggests the flaw is being used for strategic intelligence collection. Immediate patching of ownCloud instances is critical, as is a thorough review of access logs for signs of unauthorized data exfiltration.

Technical Analysis

CVE-2023-49105 is an information disclosure vulnerability in ownCloud's WebDAV API, specifically affecting the apps/dav component. The flaw stems from a failure to properly validate user-supplied paths, allowing an unauthenticated attacker to read arbitrary files from the server, including configuration files, user credentials, and other sensitive data. The CVSS 9.8 rating reflects the ease of exploitation (no authentication required) and the potential for complete compromise of confidentiality.

According to the advisory, the vulnerability affects ownCloud versions prior to 10.13.1 (for the 10.x branch) and 10.12.4 (for the 10.12.x branch). The vendor released patches in late 2023, but many instances remain unpatched, leaving them exposed. The exploit is straightforward: an attacker sends a crafted HTTP request to the /remote.php/dav/ endpoint with a path traversal sequence, bypassing access controls and retrieving file contents.

The Philippine incident, reported by The Hacker News, marks the first documented case of CVE-2023-49105 being used in a targeted attack against a nuclear research facility. The threat actor, described as Chinese-speaking, leveraged the flaw to exfiltrate records related to nuclear research, potentially including sensitive technical data. While the exact scope of the breach is not yet public, the choice of target underscores the strategic value of the stolen information.

CISA's KEV catalog addition means that federal agencies in the U.S. are now required to patch the vulnerability by a specific deadline, per Binding Operational Directive 22-01. However, the risk extends to any organization running affected ownCloud versions, particularly those in research, government, and critical infrastructure sectors.

Mitigations & Recommendations

Organizations running ownCloud should immediately apply the vendor-supplied patches for CVE-2023-49105. If patching is not immediately possible, administrators should restrict access to the WebDAV endpoint to trusted IP ranges and implement additional authentication layers, such as IP allowlisting or a reverse proxy with access controls.

Given the active exploitation, defenders should also conduct a forensic review of access logs for the /remote.php/dav/ endpoint, looking for anomalous requests that include path traversal patterns (e.g., ../) or unusual User-Agent strings. Any signs of unauthorized access should trigger a broader incident response, including credential rotation and monitoring for data exfiltration.

For long-term hardening, consider disabling the WebDAV app if it is not required for business operations, and ensure that file storage permissions are configured with the principle of least privilege. Additionally, organizations should monitor CISA's KEV catalog for updates, as new indicators of compromise may emerge as investigations continue.