On August 27, 2026, CISA added CVE-2023-49105 — an ownCloud WebDAV authentication bypass rated CVSS 9.8 — to its Known Exploited Vulnerabilities catalog under BOD 26-04, with a federal remediation deadline of August 30. The trigger was real-world exploitation, not a theoretical proof-of-concept.
According to reporting by The Hacker News and infrastructure analysis by Hunt.io, a Chinese-speaking operator used the flaw to breach a Philippine nuclear research body and a marine-engineering firm serving the Philippine Navy, staging roughly 176 files (~372 MB) — including nuclear-material account records and reactor documentation — on an open directory. The patch has existed since November 2023; the internet-facing exposure has not gone away.
◈ Table of Contents
Background & Affected Versions
Phase 01CVE-2023-49105 lives in the ownCloud Core WebDAV API. When a file owner has no signing-key configured, the server accepts pre-signed WebDAV URLs as valid authentication. An attacker who knows a valid username can therefore read, modify, or delete that user's files with no credentials at all. NVD classifies it as CWE-287 (Improper Authentication).
| Attribute | Detail |
|---|---|
| CVE | CVE-2023-49105 CVSS 9.8 Critical |
| Component | ownCloud Core — WebDAV API (pre-signed URL handling) |
| Weakness | CWE-287 Improper Authentication |
| Affected | ownCloud Core 10.6.0 – 10.13.0 |
| Fixed in | ownCloud Core 10.13.1 |
| Published | November 21, 2023 (NVD) |
| KEV added | August 27, 2026 · BOD 26-04 deadline Aug 30, 2026 |
| Preconditions | Valid username known + file owner has no signing-key set |
This CVE is part of the same disclosure batch as the CVE-2023-49103 graphapi info-leak. Organisations that only patched 49103 in 2023 may still be exposed to 49105 if signing-keys were never configured.
How the Bypass Works
Phase 02The intended design uses signed pre-authenticated links so a user can share a file without exposing their password. The flaw: the signature check passes even when the owner's signing secret is empty. That turns a would-be-protected sharing feature into an unauthenticated file-access primitive.
In this campaign, the ownCloud bypass was one of several public-facing entry techniques the operator rotated through. Reporting also ties the actor to exploitation of the LiteSpeed Cache WordPress plugin flaw CVE-2024-28000 (CVSS 9.8, unauthenticated privilege escalation), an xml-rpc brute-force script, and an EtherHiding-style ClickFix lure using Ethereum smart contracts to stage payloads.
The Chinese-language attribution signal here is source-level, not diplomatic: Hunt.io and reporting cite simplified-Chinese comments, docstrings, and log output in the actor's own tooling — an OPSEC tell, not a formal state attribution.
What Was Taken
Phase 03Investigators found an open directory on attacker infrastructure holding roughly 176 files (~372 MB) across five staging folders. The contents make the intent unambiguous — this was targeted espionage against strategic infrastructure, not opportunistic data theft.
Nuclear Records
Nuclear-material account records, reactor-core component documentation, and historical fuel inventories from the research body.
Strategic Plans
Draft strategic planning documents covering the 2023–2028 horizon.
Identity & HR Data
A ~192 MB SQL database from a ZKTeco BioTime attendance system plus employee personal information.
Secrets
BitLocker recovery keys, a KeePass database, and AxCrypt-protected files — the keys to further intrusion.
The presence of BitLocker keys and a KeePass vault in the staging set means containment cannot stop at patching ownCloud. Treat every credential and recovery key in the exposed data as compromised and rotate.
Indicators of Compromise
Phase 04| Type | Indicator | Context |
|---|---|---|
| IP | 31.58.209.241 | Attacker staging server / open directory (Hunt.io) |
| CVE (primary) | CVE-2023-49105 | ownCloud WebDAV auth bypass — initial access |
| CVE (secondary) | CVE-2024-28000 | LiteSpeed Cache WP plugin priv-esc, same actor |
| Script | brute_xmlrpc.py | WordPress XML-RPC credential brute-forcing |
| Technique | EtherHiding / ClickFix | Ethereum smart-contract-hosted lure staging |
Only the staging IP is a confirmed network IOC in public reporting. Treat it as a hunting pivot, not a blocklist silver bullet — rotate hunting to the WebDAV log patterns below rather than relying on a single address.
Detection & Hunt Queries
Phase 05Because the bypass rides the legitimate WebDAV endpoint, detection focuses on anomalous pre-signed access and unusual egress rather than a single exploit signature.
- Unauthenticated WebDAV file pulls carrying signature params
- Single-source enumeration across many file paths
- Large outbound transfers to the reported staging infrastructure
- WordPress XML-RPC brute-force noise on co-located web assets
Mitigation & Patching
Phase 06- 1Update to
10.13.1+and confirm the WebDAV pre-signed URL handling is patched. - 2Ensure a non-empty signing-key is configured for every file owner — never leave it default/empty.
- 3If patching lags the KEV deadline, pull the ownCloud WebDAV endpoint behind VPN or IP allow-listing.
- 1Rotate all secrets that may have lived in ownCloud shares — BitLocker keys, KeePass vaults, certificates.
- 2Hunt WebDAV logs for pre-signed access and enumeration bursts using the queries above.
- 3Audit co-hosted WordPress for LiteSpeed Cache (CVE-2024-28000) and XML-RPC abuse.
Two-year-old CVEs re-entering KEV are a pattern, not a fluke. A quarterly sweep of your external attack surface against the live KEV catalogue catches exactly this class of "patched long ago, still exposed" risk.
MITRE ATT&CK Mapping
Phase 07| Tactic | Technique | Use in campaign |
|---|---|---|
| Initial Access | T1190 Exploit Public-Facing Application | ownCloud WebDAV auth bypass |
| Initial Access | T1133 External Remote Services | Internet-exposed file service abuse |
| Initial Access | T1566.002 Spearphishing Link | EtherHiding / ClickFix lure |
| Collection | T1005 Data from Local System | Bulk file harvesting from shares |
| Exfiltration | T1041 Exfiltration Over C2 Channel | Transfer to staging server 31.58.209.241 |
Sources
Phase 08Is your external footprint still exposing a "patched" 2023 CVE? Run your public hostnames and file-sharing endpoints through the CyberHawk IOC Scanner, then track live exploitation on the Threat Intel feed.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."