The creators of the open-source file-sharing software ownCloud have
alerted users about three serious security vulnerabilities. These flaws could allow attackers to access confidential information and make changes to files.
Brief description of the vulnerabilities is as follows:
By infosecbulletin
/ Sunday , July 7 2024
A huge collection of passwords, containing almost ten billion unique passwords, was leaked on a popular hacking forum. The Cybernews...
Read More
By infosecbulletin
/ Sunday , July 7 2024
First get together of information security professionals community (ISPC) was held at Dhaka with a festive look with the participation...
Read More
By infosecbulletin
/ Saturday , July 6 2024
Mohammed Iqbal Hossain has been elected as the president of ISACA Dhaka chapter and Md. Abul Kalam Azad has been...
Read More
By infosecbulletin
/ Saturday , July 6 2024
A new ransomware named Eldorado appeared in March and has locker versions for VMware ESXi and Windows. The gang has...
Read More
By infosecbulletin
/ Friday , July 5 2024
French cloud computing firm OVHcloud recently handled the largest DDoS attack in terms of packet rate. This attack occurred during...
Read More
By infosecbulletin
/ Friday , July 5 2024
The web development community was affected by a supply chain attack on the popular Polyfill.io JavaScript library last week. Polyfill.js...
Read More
By infosecbulletin
/ Friday , July 5 2024
Apache Software Foundation released Apache HTTP Server version 2.4.61 to fix a serious source code disclosure vulnerability (CVE-2024-39884). This flaw...
Read More
By infosecbulletin
/ Thursday , July 4 2024
Microsoft's cybersecurity team found two major vulnerabilities in Rockwell Automation's PanelView Plus, a widely used human-machine interface in industrial settings....
Read More
By infosecbulletin
/ Thursday , July 4 2024
Cybersecurity experts found 28 new types of ransomware in June. These malicious programs are a big threat to individuals and...
Read More
By infosecbulletin
/ Wednesday , July 3 2024
ISACA Dhaka Chapter election is going to be held on Saturday (6 July) 2024. This year 23 candidates will fight...
Read More
Sensitive credentials and configuration in container deployments for graphapi versions 0.2.0 to 0.3.0 were exposed, leading to a security vulnerability with a CVSS score of 10.0.
WebDAV API authentication bypass through the use of pre-signed URLs affects core versions 10.6.0 to 10.13.0. This vulnerability has a CVSS score of 9.8.
Subdomain Validation Bypass impacting oauth2 prior to version 0.6.1 (CVSS score: 9.0)
“The first vulnerability involves the ‘graphapi’ app relying on a third-party library that exposes the PHP environment configuration details (phpinfo).”
“This information includes all the environment variables of the web server. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.”
To fix the issue, ownCloud suggests removing the “owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php” file and disabling the ‘phpinfo’ function. Additionally, users are advised to update their ownCloud admin password, mail server and database credentials, and Object-Store/S3 access keys.
The second problem allows anyone to access, modify, or delete any file without needing authentication if they know the victim’s username and the victim hasn’t set up a signing-key, which is the default setting.
“Lastly, the third flaw relates to a case of improper access control that enables an attacker to redirect callbacks to a TLD controlled by the attacker without undergoing validation.”
Besides adding hardening measures to the validation code in the oauth2 app, ownCloud has suggested that users disable the “Allow Subdomains” option as a workaround.