ownCloud CVE-2023-49105 hits KEV: a 2023 bug still pays

CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog this week — an ownCloud WebDAV authentication bypass that ownCloud disclosed and fixed in November 2023. A suspected Chinese-speaking operator used it to walk out of a Philippine nuclear research agency with files. The bug is nearly three years old, carries a CVSS of 9.8, and works against the default configuration. That combination is why it is still earning.

What actually happened

Per Hunt.io's research on the intrusion, the operator left an open directory that exposed the whole operation on August 13, 2026.

The ownCloud flaw: pre-signed URLs in the WebDAV API are validated against a signing key. ownCloud's own advisory states it plainly — an attacker who knows a valid username can access, modify, or delete any file without authentication if the victim "has no signing-key configured (which is the default)." Affected core versions run 10.6.0 through 10.13.0.

What it produced: 176 files, roughly 372 MB, staged across five directories from the nuclear research entity, with CSV manifests in the toolkit pointing at a materially larger haul. The stolen material included nuclear material records, research reactor data, personnel files, and encryption key material.

The same operator hit a marine engineering firm supporting the Philippine Navy through CVE-2024-28000, a LiteSpeed Cache WordPress privilege-escalation bug patched in version 6.4 back in August 2024 — pulling 195 MB including a full database dump, plus a 192 MB SQL dump of a BioTime attendance system covering personnel records through December 2024.

The tooling is unremarkable, which is the point: five custom Python scripts for the ownCloud exploit, a Go reimplementation of the LiteSpeed bug, an XML-RPC brute-forcer, and off-the-shelf Sliver, Metasploit, and Mettle. No zero-days.

Why an old CVE matters for your business

Two patched bugs. Two years of available fixes. Two organizations that were, on paper, high-value targets. The attacker's entire edge was that nobody upgraded the file server.

Self-hosted file sync is the classic orphan service. Somebody stood up ownCloud in 2022 so the team could share large files without a Dropbox invoice, it worked, and it fell out of everyone's mental model of "the stack." It is internet-facing, it holds every document anyone ever dragged into it, and it has no owner. Same story for the WordPress install that runs marketing — same argument we made about last week's plugin batch.

The fix is not a tool. It is an inventory that includes the boring boxes: every internet-facing service, its version, its owner, its last patch date. If you cannot produce that list in an hour, you have this exposure somewhere.

Then the specific work. If you run ownCloud, Hunt.io recommends upgrading to 10.13.3 or later and configuring a real signing key — the empty default is the whole vulnerability. Disable or restrict XML-RPC on WordPress. Enforce MFA on admin accounts. Alert on unusual WebDAV patterns, because a directory-walk of your document store looks nothing like normal use.

And the point KEV keeps making: prioritize by exploitation, not by severity. A three-year-old 9.8 that attackers are actively running outranks the new critical nobody has weaponized yet.

Sources: Hunt.io, ownCloud Security Advisories, CISA Known Exploited Vulnerabilities Catalog.