ownCloud Improper Authentication Vulnerability (WebDAV API Bypass)

Technical Analysis

CVE-2023-49105 stems from the ownCloud WebDAV API's pre-signed URL feature, where the application improperly validates authentication when a user has no signing-key configured, allowing attackers to forge valid requests using only a known username. This enables unauthenticated attackers to read, modify, or delete arbitrary files stored in the ownCloud instance, and potentially retrieve sensitive configuration data such as environment variables via related information disclosure paths in the same vulnerability class. Exploitation requires no credentials beyond a valid username, which can often be enumerated or guessed, making this a low-complexity, high-impact attack vector. If AI agents or RAG pipelines use ownCloud as a document repository or file-sharing backend, this vulnerability could allow attackers to poison training/context data, exfiltrate proprietary documents ingested by agents, or tamper with files that agents later retrieve and act upon, leading to downstream data integrity and prompt-injection style risks.

Affected Systems

ownCloud core versions using the WebDAV API pre-signed URL feature where no signing-key is configured; specifically ownCloud instances prior to patched releases (owncloud/core 10.13.1 and later fixes apply). Deployments using default or misconfigured signing-key settings are most at risk.

Indicators of Compromise

• No specific hashes, IPs, or domains publicly attributed to this CVE at time of writing; monitor ownCloud access logs for anomalous WebDAV requests using pre-signed URLs without corresponding authentication headers, and unexpected file modification/deletion events tied to known usernames.

Remediation Steps

1. 1

   Apply vendor patch

   Upgrade ownCloud core to the fixed version addressing CVE-2023-49105 as specified in ownCloud's security advisory.

2. 2

   Configure signing-keys

   Ensure all user accounts have a signing-key properly configured to prevent exploitation of the pre-signed URL authentication bypass.

3. 3

   Audit file access logs

   Review WebDAV and file access logs for unauthorized access, modification, or deletion of files, particularly involving known or enumerable usernames.

4. 4

   Restrict WebDAV exposure

   Limit external network exposure of the ownCloud WebDAV API and apply network-level access controls where feasible.

5. 5

   Rotate credentials and review agent integrations

   If AI agents or automation pipelines connect to ownCloud, rotate any API keys/tokens and validate that ingested files have not been tampered with.