威胁英特尔更新：ownCloud漏洞

Download

About The Author

Tom Gorup

As the Vice President of Security Services at Edgio, Tom Gorup leads a team of security professionals who deliver world-class security solutions to customers across various industries. He is responsible for overseeing the company's global security operations, ensuring the highest standards of quality, efficiency, and customer satisfaction. Tom has over 15 years of experience in managing security operations, from co-founding and running a successful MDR startup to directing a large-scale SOC at a leading cloud security provider. He has a proven track record of building and growing security teams, developing innovative technologies and processes, and securing organizations from emerging threats. He is also a recognized thought leader and speaker in the security industry, as well as a decorated veteran who served in the U.S. Army. Tom is passionate about advancing the field of cybersecurity and empowering his team to deliver the best security outcomes for their customers.

Download

2023年11月21日,ownCloud宣布了其核心(CVE-2023-49105)，OAuth (CVE-2023-49104)和Graphapi (CVE-2023-49103)库中的三个主要漏洞。

Edgio Security产品套件可通过启用虚拟修补来加快零日补救，帮助在这些不断演变的威胁中保持领先地位。尽管我们通过默认规则为客户提供保护，以抵御这些威胁，但我们强烈建议您也按照供应商的说明对所有受影响的设备采取建议的措施。如果您在保护自己的Cloud实例方面有疑虑或需要额外支持,请联系Edgio SOC电子邮件tickets@edg.io寻求帮助。

建议：

容器化部署中敏感凭据和配置的披露(CVE-2023-49103)：

CVSS得分：10.0严重
影响:此严重漏洞影响0.2.1之前的ownCloud/graphapi版本0.2.x和0.3.1之前的0.3.x。它公开了PHP环境的配置细节,包括敏感数据,如ownCloud管理员密码，邮件服务器凭据和许可证密钥简单地禁用graphapi应用程序并不能消除漏洞。
操作：删除文件owncloud/apps/graphapi/vendor/Microsoft/Microsoft-graph/tests/GetPhpInfo.php。禁用Docker-containers中的phpinfo功能。更改自己的Cloud管理员密码，邮件服务器凭据，数据库凭据和Object-Store/S3访问权限key。

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49103

https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/

子域验证绕过(CVE-2023-49104)：

CVSS评分：8.7偏高
影响：此严重漏洞影响0.6.1之前的ownCloud/oauth2版本。它允许攻击者传递特制的重定向URL，从而绕过任何重定向URL验证，并在启用”允许子域”功能时将回拨重定向到攻击者控制的任何备用顶级域。
操作：强化oauth2应用程序中的属性验证代码。作为解决方法，可以禁用”允许子域”选项以防止n ü vulnerability。

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49104

https://owncloud.com/security-advisories/subdomain-validation-bypass/

使用预签名URL的WebDAV API身份验证绕过(CVE-2023-49105)：

CVSS得分：9.8严重
影响：此高风险问题影响ownCloud/core 10.6.0至10.13.0版本。如果攻击者知道受害者的用户名并且受害者没有配置签名密钥，则攻击者可以在未经身份验证的情况下访问，修改或删除任何文件。
操作：如果没有为n ü files 的所有者配置”签名密钥”，则拒绝使用预先签名的URL。

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49105

https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/

ownCloud的用户和管理员必须定期查看安全通报并实施建议的措施来保护其系统。