ownCloud Core WebDAV API Authentication Bypass via Pre-Signed URLs (CVE-2023-49105)

1. Official Security Patch

Upgrade your ownCloud Core installation to version 10.13.1 or later immediately.

2. Temporary Mitigations

• Enforce Signing Keys: Ensure and enforce that all active user accounts have a valid signing key configured.
• Restrict WebDAV API Access: Implement network-level ACLs or WAF rules to restrict access to WebDAV endpoints (e.g., /remote.php/dav) only to trusted IP addresses.
• WAF Detection Rules: Deploy WAF signatures to detect and block anomalous WebDAV requests containing pre-signed URL parameters (OC-Signature, OC-Credential) associated with unauthenticated sessions.

This vulnerability (CVE-2023-49105) is a critical authentication bypass (CWE-287) residing in the WebDAV API implementation of ownCloud Core.

ownCloud utilizes pre-signed URLs to facilitate secure, time-limited file sharing. Under normal operations, the system must validate these URLs against the file owner's signing key. However, a logical flaw exists where pre-signed URLs are accepted as valid even when no signing key is configured for the owner of the files.

Consequently, if an attacker knows the username of a target victim who lacks a configured signing key, they can craft arbitrary pre-signed URLs to bypass authentication entirely. This grants the attacker full unauthorized access (read, write, delete) to the victim's files via the WebDAV interface. With a CVSS score of 9.8 and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat to exposed ownCloud instances.