A 2023 ownCloud auth-bypass CVE re-enters CISA KEV because Hunt.io caught a suspected Chinese-speaking operator's open staging server using it to steal nuclear-research and naval-contractor data from two Philippine organisations
CISA added CVE-2023-49105 (ownCloud core <10.13.1, WebDAV pre-signed-URL authentication bypass, CVSS 9.8) back into its Known Exploited Vulnerabilities catalog on 2026-08-27 — three years after original disclosure — on the strength of a finding from Hunt.io's Attack Capture platform. On 2026-08-13, Hunt.io found an open directory at an Amsterdam-hosted server exposing 1,310 files across 86 subdirectories of a suspected Chinese-speaking operator's offensive tooling and exfiltrated data. Hunt.io disclosed the findings to CERT-PH under TLP:AMBER and held publication until 2026-08-25 while CERT-PH coordinated victim notification.
The vulnerable pattern: when an ownCloud instance has no signing key configured for pre-signed URLs — a default install state — the signing routine still executes using an empty secret. "An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials" (Hunt.io, 2026-08-25). Five custom Python scripts recovered from the directory implement this technique against a Philippine nuclear-research body's ownCloud instance — four hardcode a single target account each, the fifth adds directory enumeration and logging — retrieving research-reactor core-component data, fuel-inventory records, radiation-safety documents, staff PII and credential stores (BitLocker, KeePass, AxCrypt) via unauthenticated WebDAV GET requests with a forged OC-Credential header: "the scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV" (Hunt.io, 2026-08-25). A recovered CSV references roughly 9 GB stolen from the nuclear agency, most no longer present in the directory, plus a compromise of an unnamed project-management application — a possible third victim.
A separate intrusion, likely by the same operator, compromised a Philippine marine-engineering/shipbuilding firm that services the Philippine Navy via CVE-2024-28000 (LiteSpeed Cache WordPress plugin, unauthenticated privilege escalation via a weakly-seeded mt_rand() security hash) — the operator's custom Go tooling included a verified re-implementation of PHP's MT19937 PRNG — plus XML-RPC (/xmlrpc.php) credential brute-forcing using the rockyou.txt wordlist against the "admin" account, producing a new admin account and a valid credential pair. A complete WordPress install tree, database dump and media library (195 MB total) were exfiltrated. Simplified-Chinese code comments, docstrings, log markers and data-sorting folder names support the Chinese-speaking-operator assessment: "Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator" (Hunt.io, 2026-08-25), at "likely" confidence overall for targeted-collection framing. Hunt.io separately found unrelated EtherHiding-style JavaScript malware already present on the compromised WordPress site, explicitly noting no evidence links that activity to the same operator.
Hunt.io's own ATT&CK mapping for this operation covers exploitation of both public-facing applications (T1190), development of custom exploit capabilities (T1587.004, the custom Go CVE-2024-28000 tool), local-account creation (T1136.001, the rogue WordPress admin), and archive collection of staged exfiltration data (T1560). Recommended mitigations beyond the ownCloud signing key: patch LiteSpeed Cache to 6.4+ and disable XML-RPC or restrict /xmlrpc.php to trusted sources.
The transferable lesson for this constituency does not depend on the Philippine victim set: a chipset-free, purely configuration-driven authentication bypass in a widely self-hosted file-sync product, still exploitable through a default install state three years after disclosure, is exactly the class of gap a version-only vulnerability audit misses — the CVE is "fixed" in any current ownCloud release, but the empty-signing-key exposure persists wherever an operator never explicitly configured the key. Triage: unauthenticated WebDAV GET requests carrying a signed pre-signed-URL parameter but no corresponding valid signing-key configuration, and WebDAV access patterns naming known usernames without any prior authentication event in the same session, are the discriminators — legitimate pre-signed-URL use always follows a configured, non-empty signing key and an issuing authenticated session.
The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV.
In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.
Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator.
Defender actions
- Set a strong, non-empty ownCloud signing key wherever pre-signed URLs are used — the default empty-secret state is what makes this exploitable, independent of the CVE's three-year age, and any instance never explicitly configured with a key should be treated as exposed regardless of version.
- Patch LiteSpeed Cache to 6.4 or later and disable XML-RPC or restrict /xmlrpc.php to trusted sources on any WordPress site — this campaign's second access path combined a weakly-seeded mt_rand() exploit against LiteSpeed Cache with XML-RPC credential brute-forcing to create a new admin account.
ATT&CK mapping
4 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Resource Development TA0042
T1587.004Develop Capabilities: Exploits
Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits. Adversaries may use information acquired via Vulnerabilities to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Persistence TA0003
T1136.001Create Account: Local Account
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
Collection TA0009
T1560Archive Collected Data
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.