CVE-2023-49105: 
ownCloud vulnerability analysis and mitigation

A critical authentication bypass vulnerability (CVE-2023-49105) was discovered in ownCloud versions 10.6.0 to 10.13.0. The vulnerability allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known and the victim has no signing-key configured, which is the default setting (ownCloud Advisory, Arctic Wolf).

The vulnerability has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. This vulnerability affects all installations, not just Docker-based ones (GreyNoise Blog).

Successfully exploiting CVE-2023-49105 can lead to severe consequences including data theft, unauthorized file access, modification or deletion of any file in the system, and potential remote code execution. The vulnerability affects all installations of the affected versions, making it particularly dangerous (GreyNoise Blog).

A proof-of-concept (PoC) exploit code has been made publicly available. The vulnerability is relatively straightforward to exploit as it only requires knowledge of a target username and does not require authentication. The default configuration of ownCloud makes it vulnerable as users typically don't have signing keys configured (Security Online).

The primary mitigation is to upgrade to ownCloud version 10.13.1 or later, which contains the fix for this vulnerability. The fix involves denying the use of pre-signed URLs if no signing-key is configured for the owner of the files (ownCloud Advisory).

While this vulnerability initially received less attention than the CVSS 10.0 vulnerability (CVE-2023-49103) released at the same time, security researchers have noted that CVE-2023-49105 is arguably more severe due to its broader impact on all installations. GreyNoise has developed a tag for monitoring exploitation attempts but has not observed active exploitation in the wild (GreyNoise Blog).