CVE-2023-49105

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2023-49105 9.8

ownCloud · ownCloud · Added 2026-08-27 · Published 2023-11-21

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityownCloud Improper Authentication Vulnerability

VendorownCloud

ProductownCloud

Date added2026-08-27

Due date2026-08-30

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-287

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.

NVD: An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-27 18:07 UTC

Searches6

Component defaultyes

Sources https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
https://github.com/ambionics/owncloud-exploits
https://www.labs.greynoise.io/grimoire/2023-12-05-owncloud-again-again/
https://www.greynoise.io/blog/cve-2023-49105-webdav-api-authentication-bypass-in-owncloud
https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-49105.yaml
https://www.ambionics.io/blog/owncloud-cve-2023-49103-cve-2023-49105
https://owncloud.com/blogs/immediate-action-required-critical-security-updates-for-owncloud/
https://github.com/advisories/GHSA-585g-f852-v6p4

Hunting hypothesis agent

Hunt ownCloud access logs for WebDAV requests containing OC-Credential, OC-Date, OC-Expires, OC-Verb, and OC-Signature query parameters on /remote.php/dav/ paths. Forgeries use PBKDF2-SHA512 with an empty signing key.

Research details

ComponentWebDAV pre-signed URL verifier (lib/private/Security/SignedUrl/Verifier.php)

PreconditionsNetwork access to the ownCloud WebDAV endpoint (remote.php/dav or remote.php/webdav); knowledge of a valid target username; the target user must not have a signing-key configured (the default for all users). Affected versions: ownCloud core 10.6.0 through 10.13.0. No authentication is required. agent

DeliveryNetwork

Public PoCyes

PoC URLs https://github.com/ambionics/owncloud-exploits
https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-49105.yaml Third-party repos; verify before use.

Advisoryhttps://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/

Exploit notesPublic PoC available — Python exploit (pwncloud-webdav.py) sets up a local proxy that automatically signs any WebDAV request with forged OC-* query parameters (OC-Credential, OC-Date, OC-Expires, OC-Verb, OC-Signature). Uses PBKDF2-SHA512 with an empty signing key to compute a valid 64-char hex signature. Also has a Nuclei template for detection. GreyNoise blog confirms reproduction. CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0)

SummaryownCloud Server 10.6.0 through 10.13.0 has a WebDAV pre-signed URL authentication bypass. When a user has no signing-key (the default), Verifier.php computes PBKDF2-SHA512 with an empty key, letting attackers forge OC-* query parameter signatures for full file access. A public Python exploit and Nuclei template exist. Upgrade to 10.13.1+ or apply the vendor patch.

Tia coverage

First reported2026-08-27

First exploit report2026-08-27

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chinese-speaking-hackers-exploit-known-flaws-to-steal-philippine

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.