A 2023 ownCloud auth-bypass CVE re-enters CISA KEV because Hunt.io caught a suspected Chinese-speaking operator's open staging server using it to steal nuclear-research and naval-contractor data from two Philippine organisations

CISA added CVE-2023-49105 (ownCloud core <10.13.1, WebDAV pre-signed-URL authentication bypass, CVSS 9.8) back into its Known Exploited Vulnerabilities catalog on 2026-08-27 (three years after original disclosure) on the strength of a finding from Hunt.io's Attack Capture platform. On 2026-08-13, Hunt.io found an open directory at an Amsterdam-hosted server exposing 1,310 files across 86 subdirectories of a suspected Chinese-speaking operator's offensive tooling and exfiltrated data. Hunt.io disclosed the findings to CERT-PH under TLP:AMBER and held publication until 2026-08-25 while CERT-PH coordinated victim notification.

The vulnerable pattern: when an ownCloud instance has no signing key configured for pre-signed URLs (a default install state) the signing routine still executes using an empty secret. "An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials" (Hunt.io, 2026-08-25). Five custom Python scripts recovered from the directory implement this technique against a Philippine nuclear-research body's ownCloud instance (four hardcode a single target account each, the fifth adds directory enumeration and logging) retrieving research-reactor core-component data, fuel-inventory records, radiation-safety documents, staff PII and credential stores (BitLocker, KeePass, AxCrypt) via unauthenticated WebDAV GET requests with a forged OC-Credential header: "the scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV" (Hunt.io, 2026-08-25). A recovered CSV references roughly 9 GB stolen from the nuclear agency, most no longer present in the directory, plus a compromise of an unnamed project-management application, a possible third victim.

A separate intrusion, likely by the same operator, compromised a Philippine marine-engineering/shipbuilding firm that services the Philippine Navy via CVE-2024-28000 (LiteSpeed Cache WordPress plugin, unauthenticated privilege escalation via a weakly-seeded mt_rand() security hash) (the operator's custom Go tooling included a verified re-implementation of PHP's MT19937 PRNG) plus XML-RPC (/xmlrpc.php) credential brute-forcing using the rockyou.txt wordlist against the "admin" account, producing a new admin account and a valid credential pair. A complete WordPress install tree, database dump and media library (195 MB total) were exfiltrated. Simplified-Chinese code comments, docstrings, log markers and data-sorting folder names support the Chinese-speaking-operator assessment: "Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator" (Hunt.io, 2026-08-25), at "likely" confidence overall for targeted-collection framing. Hunt.io separately found unrelated EtherHiding-style JavaScript malware already present on the compromised WordPress site, explicitly noting no evidence links that activity to the same operator.

Hunt.io's own ATT&CK mapping for this operation covers exploitation of both public-facing applications (T1190), development of custom exploit capabilities (T1587.004, the custom Go CVE-2024-28000 tool), local-account creation (T1136.001, the rogue WordPress admin), and archive collection of staged exfiltration data (T1560). Recommended mitigations beyond the ownCloud signing key: patch LiteSpeed Cache to 6.4+ and disable XML-RPC or restrict /xmlrpc.php to trusted sources.

The transferable lesson does not depend on the Philippine victim set: a purely configuration-driven authentication bypass in a widely self-hosted file-sync product, still exploitable through a default install state three years after disclosure, is exactly the class of gap a version-only vulnerability audit misses; the CVE is "fixed" in any current ownCloud release, but the empty-signing-key exposure persists wherever an operator never explicitly configured the key. Triage: unauthenticated WebDAV GET requests carrying a signed pre-signed-URL parameter but no corresponding valid signing-key configuration, and WebDAV access patterns naming known usernames without any prior authentication event in the same session, are the discriminators; legitimate pre-signed-URL use always follows a configured, non-empty signing key and an issuing authenticated session.