--- schema: 1 kind: threat title: "A 2023 ownCloud auth-bypass CVE re-enters CISA KEV because Hunt.io caught a suspected Chinese-speaking operator's open staging server using it to steal nuclear-research and naval-contractor data from two Philippine organisations" headline: "An empty pre-signed-URL signing key — a default install state — let attackers forge authenticated WebDAV requests against a nuclear agency's file store" summary: > CISA re-added CVE-2023-49105 (ownCloud core <10.13.1, CVSS 9.8) to KEV on 2026-08-27, three years after disclosure, after Hunt.io found an open directory exposing a suspected Chinese-speaking operator's tooling and exfiltrated data from a Philippine nuclear-research body and a marine-engineering/shipbuilding firm servicing the Philippine Navy. The technique — pre-signed WebDAV URLs signed with an empty default secret — and a second CVE (LiteSpeed Cache, CVE-2024-28000) together yielded credential stores, research-reactor data and a full WordPress compromise. discovered_at: "2026-08-28T05:52:00Z" updated_at: null event_date: "2026-08-25" run_id: 2026-08-28T0409Z-intel priority: high immediate_action: null tags: [vulnerabilities, actively-exploited, cisa-kev, patch-available, nation-state, espionage, data-breach] regions: [global, apac] sectors: [public-sector, energy, technology] entities: [] techniques: [T1190, T1587.004, T1136.001, T1560] affected_products: ["ownCloud core (owncloud/core)", "LiteSpeed Cache (WordPress plugin)"] cves: - id: CVE-2023-49105 cvss: "9.8" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "ownCloud core <10.13.1" fixed: "10.13.1+" - id: CVE-2024-28000 cvss: null epss: null type: priv-esc vector: zero-click auth: pre-auth status: [exploited, patch-available] affected: "LiteSpeed Cache (WordPress plugin) <6.4" fixed: "6.4+" sources: - url: "https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor" publisher: "Hunt.io (Hunt Intelligence)" date: "2026-08-25" role: primary - url: "https://www.labs.greynoise.io/grimoire/2023-12-05-owncloud-again-again/index.html" publisher: "GreyNoise Labs" date: "2023-12-05" role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA Known Exploited Vulnerabilities Catalog (JSON feed)" date: "2026-08-27" role: primary closed_sources: [] evidence: - quote: "The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV." publisher: "Hunt.io" - quote: "In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials." publisher: "Hunt.io" - quote: "Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator." publisher: "Hunt.io" verification: multi-source sourcing_note: > Hunt.io is the primary technical source, disclosing findings from its own Attack Capture platform; GreyNoise Labs' 2023 grimoire post corroborates the vulnerability class and its history of exploitation independent of this specific campaign. No named cluster or campaign codename was given by Hunt.io ("suspected Chinese-speaking operator" only), so no new actor entity is proposed. Out-of-nexus victims (Philippines) — included for global significance (a nuclear-research target) and a same-actor-class read (Chinese state-nexus-adjacent activity plausibly also targeting this constituency's CI/government core). confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 1 watchlist_hit: false actions: - "Set a strong, non-empty ownCloud signing key wherever pre-signed URLs are used — the default empty-secret state is what makes this exploitable, independent of the CVE's three-year age, and any instance never explicitly configured with a key should be treated as exposed regardless of version." - "Patch LiteSpeed Cache to 6.4 or later and disable XML-RPC or restrict /xmlrpc.php to trusted sources on any WordPress site — this campaign's second access path combined a weakly-seeded mt_rand() exploit against LiteSpeed Cache with XML-RPC credential brute-forcing to create a new admin account." updates: - at: "2026-08-28T15:00:00Z" run_id: 2026-08-28T1500Z-audit type: improvement internal: true summary: > Operator-directed editorial pass (v4.2): removed composition-rationale narration and pipeline-internal jargon from reader-facing text; tightened or cut paragraphs that restated the summary or padded without responder value. No factual claim changed. fields: [sourcing_note, body] - at: "2026-08-30T13:12:06Z" run_id: 2026-08-30T1312Z-audit type: correction summary: > The EPSS value carried for CVE-2023-49105 was wrong and had no source. It was recorded as "11.07" while none of the three cited sources mentions EPSS at all, and the live FIRST EPSS API returns 0.43205 for this CVE, about four times higher on any reading of the published figure. The field is set to null rather than to today's score, because no source this entry cites publishes one and a probability that moves daily does not belong in a static record. The same pass added the third class of stolen data on the operator's staging server, which Hunt.io lists among its own key findings and this entry had omitted. fields: [cves, body] migrated_from: null --- CISA added CVE-2023-49105 (ownCloud core <10.13.1, WebDAV pre-signed-URL authentication bypass, CVSS 9.8) back into its Known Exploited Vulnerabilities catalog on 2026-08-27 — three years after original disclosure — on the strength of a finding from Hunt.io's Attack Capture platform. On 2026-08-13, Hunt.io found an open directory at an Amsterdam-hosted server exposing 1,310 files across 86 subdirectories of a suspected Chinese-speaking operator's offensive tooling and exfiltrated data. Hunt.io disclosed the findings to CERT-PH under TLP:AMBER and held publication until 2026-08-25 while CERT-PH coordinated victim notification. The vulnerable pattern: when an ownCloud instance has no signing key configured for pre-signed URLs — a default install state — the signing routine still executes using an empty secret. "An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials" ([Hunt.io, 2026-08-25](https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor)). Five custom Python scripts recovered from the directory implement this technique against a Philippine nuclear-research body's ownCloud instance — four hardcode a single target account each, the fifth adds directory enumeration and logging — retrieving research-reactor core-component data, fuel-inventory records, radiation-safety documents, staff PII and credential stores (BitLocker, KeePass, AxCrypt) via unauthenticated WebDAV GET requests with a forged OC-Credential header: "the scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV" ([Hunt.io, 2026-08-25](https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor)). A recovered CSV references roughly 9 GB stolen from the nuclear agency, most no longer present in the directory, plus a compromise of an unnamed project-management application — a possible third victim. A separate intrusion, likely by the same operator, compromised a Philippine marine-engineering/shipbuilding firm that services the Philippine Navy via CVE-2024-28000 (LiteSpeed Cache WordPress plugin, unauthenticated privilege escalation via a weakly-seeded `mt_rand()` security hash) — the operator's custom Go tooling included a verified re-implementation of PHP's MT19937 PRNG — plus XML-RPC (`/xmlrpc.php`) credential brute-forcing using the `rockyou.txt` wordlist against the "admin" account, producing a new admin account and a valid credential pair. A complete WordPress install tree, database dump and media library (195 MB total) were exfiltrated. Simplified-Chinese code comments, docstrings, log markers and data-sorting folder names support the Chinese-speaking-operator assessment: "Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator" ([Hunt.io, 2026-08-25](https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor)), at "likely" confidence overall for targeted-collection framing. Hunt.io separately found unrelated EtherHiding-style JavaScript malware already present on the compromised WordPress site, explicitly noting no evidence links that activity to the same operator. Hunt.io's own ATT&CK mapping for this operation covers exploitation of both public-facing applications (T1190), development of custom exploit capabilities (T1587.004, the custom Go CVE-2024-28000 tool), local-account creation (T1136.001, the rogue WordPress admin), and archive collection of staged exfiltration data (T1560). Recommended mitigations beyond the ownCloud signing key: patch LiteSpeed Cache to 6.4+ and disable XML-RPC or restrict `/xmlrpc.php` to trusted sources. The transferable lesson does not depend on the Philippine victim set: a purely configuration-driven authentication bypass in a widely self-hosted file-sync product, still exploitable through a default install state three years after disclosure, is exactly the class of gap a version-only vulnerability audit misses — the CVE is "fixed" in any current ownCloud release, but the empty-signing-key exposure persists wherever an operator never explicitly configured the key. **Triage:** unauthenticated WebDAV GET requests carrying a signed pre-signed-URL parameter but no corresponding valid signing-key configuration, and WebDAV access patterns naming known usernames without any prior authentication event in the same session, are the discriminators — legitimate pre-signed-URL use always follows a configured, non-empty signing key and an issuing authenticated session. ## Correction — 2026-08-30T13:12:06Z The EPSS figure this entry carried for CVE-2023-49105 was wrong and unsourced, and has been removed. It read 11.07; the FIRST EPSS API returns 0.43205 for this CVE as of 2026-08-29, and none of the sources cited here publishes an EPSS score at all. Nothing else in the assessment turned on it: the CVE is CISA KEV-listed and the exploitation evidence in this entry comes from observed activity, not from a probability estimate. Hunt.io's own key findings also name a third class of stolen data recovered from the same staging server, which this entry had left out: "A 192 MB SQL dump from a ZKTeco BioTime attendance and personnel database, recovered from the same server, referenced multiple related Philippine science and research organizations, indicating a possible focus on tracking individuals working for these institutions" ([Hunt.io, 2026-08-27](https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor)). That broadens the read on this operator: alongside the nuclear-agency and shipbuilder material already described, it was holding an HR and biometric attendance database spanning several institutions, which points at personnel tracking as an objective and at a workforce-management integrator as a likely additional access path.