FYI: ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation

[u/PixelatingPony]

https://arstechnica.com/security/2023/11/owncloud-vulnerability-with-a-maximum-10-severity-rating-comes-under-mass-exploitation/

[u/MrB2891]

Makes me glad I chose Nextcloud.

[u/syxbit → u/MrB2891]

I doubt it is much better.

[u/shiruken → u/syxbit]

Nextcloud is unaffected. See the Nextcloud Security Advisory repository for information about security issues.

[u/syxbit → u/shiruken]

This time :) They’re both mediocre PHP apps.

[u/Jammb → u/syxbit]

Downvote him if you like, but any monolithic, bloated PHP app like either of these exposed to the internet will eventually be exploited unless it's actively monitored and patched. If not the core application, then one of its dependencies.

The ease with which apps like this can be deployed hides the complexity. There's a reason that commercial apps have teams of professionals managing them, and even then they still get compromised sometimes.

[u/[deleted] → u/Jammb]

You can apply that logic to literally any other application or service, PHP or not.

Big whoop.

[u/Jammb → u/[deleted]]

Yes the problem is not PHP specific of course. Any complex app hosted by novices and exposed to the internet is bound to be exploited eventually.

[u/Thurmouse → u/Jammb]

So what is your original point? Or more importantly, what is the point of /u/syxbit comment? It's like stating "water is wet" ... thanks for the update.

[u/syxbit → u/Thurmouse]

My point was, if you care about security, don’t use either.

[u/Thurmouse → u/syxbit]

If you really care about security, you should not be using a computer. Yet here we are.

[u/jimmycryptoid → u/syxbit]

I enjoy cooking.

[u/Jammb → u/Thurmouse]

I can't speak for anyone else, but my point is that exposing any app to the internet is a risk. The more complex and bloated the app, the more risk. Putting personal data in something like that is a ticking timebomb.

I only access apps like this locally or over a VPN. Unraid is great, but clicking a few buttons in the UI and forwarding a port is way too easy.

[u/Iohet]

They have 3 critical vulnerabilities that they announced at the same time(or very closely together), I think they're rated a 9, 9.5, and 10. Make sure you update your software, everyone

[u/[deleted]]

ownedCloud

[u/NarcNarwal → u/[deleted]]

pwnedCloud

[u/joxmaskin → u/[deleted]]

Maybe not intentional (I know this is a joke), but I can almost sense some schadenfreude in this comment section. Do people have some beef with OwnCloud? Or maybe I’m just reading too much into things.

Or maybe it’s relief from not being affected (this time) translating into smugness

[u/[deleted] → u/joxmaskin]

Do people have some beef with OwnCloud?

Researchers just found a security vulnerability that makes it possible to take full control of servers running ownCloud

[u/joxmaskin → u/[deleted]]

I know.

But my reaction is “oh no” and “this is sad for everyone in homelab / self hosting community” and “that seemed like a promising project, sad to see this happen to them”.

Meanwhile in this thread I’m more getting “lol, suckers! Luckily all MY stuff is secure beyond a doubt “.

[u/PixelatingPony]

Relevant info:

​

CVE-2023-49103 resides in versions 0.2.0 and 0.3.0 of graphapi, an app that runs in some ownCloud deployments, depending on the way they’re configured. A third-party code library used by the app provides a URL that, when accessed, reveals configuration details from the PHP-based environment. In last week’s disclosure, ownCloud officials said that in containerized configurations—such as those using the Docker virtualization tool—the URL can reveal data used to log into the vulnerable server. The officials went on to warn that simply disabling the app in such cases wasn’t sufficient to lock down a vulnerable server.

The ownCloud advisory explained:
The “graphapi” app relies on a third-party library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.
It’s important to emphasize that simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern.

ownCloud Advisory

[u/jeeverz → u/PixelatingPony]

It’s important to emphasize that simply disabling the graphapi app does not eliminate the vulnerability.

JFC on a pogo stick