ownCloud — Critical WebDAV API Flaw Weaponized for Cyberespionage Against Philippine Nuclear Infrastructure (CVE-2023-49105)

Publication date: August 28, 2026
Category: Vulnerability / Cyber Espionage / Threat Intelligence

Introduction

In late August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) formally added a critical authentication bypass vulnerability in the ownCloud WebDAV API, tracked as CVE-2023-49105, to its Known Exploited Vulnerabilities (KEV) catalog. This action follows threat intelligence reports revealing that a Chinese-speaking cyberespionage actor weaponized the flaw to breach and exfiltrate confidential data from a nuclear research body and a marine engineering firm in the Philippines. Concurrently, security defenders have had to address additional vectors across caching plugins and development environments, illustrating a coordinated campaign against critical defense and research assets in Southeast Asia.

What is ownCloud and CVE-2023-49105? (General Analysis)

ownCloud is a widely deployed open-source Enterprise File Synchronization and Sharing (EFSS) platform utilized by public and private organizations to maintain sovereign control over their file repositories.

The vulnerability CVE-2023-49105 directly impacts ownCloud “core” versions 10.6.0 through 10.13.0, with a fix released in version 10.13.1. This flaw allows an unprivileged attacker to access, modify, or delete any file without authentication if the victim’s username is known and no signing-key is configured—a behavior that served as the default configuration across affected setups.

Official Technical Data (NVD):

  • CVE ID: CVE-2023-49105
  • CVSS v3.1 Score: 9.8 (CRITICAL)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CWE Classification: CWE-287 (Improper Authentication)
  • CISA KEV Catalog: Yes

How Does It Work? (Technical Analysis)

The exploitation mechanism uncovered by threat intelligence firms relies on manipulating pre-signed URLs generated with an empty signing secret.

  • Initial Entry Flow: The threat actor identifies exposed directories on misconfigured servers and exploits the authentication bypass in the WebDAV interface. By knowing or enumerating a valid username on the ownCloud instance (such as administrative or research accounts), the attacker’s script constructs artificially signed requests.
  • Validation and Abuse: Because no signing key is configured for the target user profile, the ownCloud server accepts the requests as a legitimate authentication action originating from that user, allowing unauthorized file retrieval without supplying account credentials.
  • Execution and Exfiltrated Data: During the intrusion into the Philippine nuclear agency, operators utilized five custom Python scripts to automate enumeration and selective downloads. Approximately 176 files (372 MB) were exfiltrated, including nuclear material account records, 2023–2028 strategic plans, research reactor core components, historical fuel inventories, and credential stores (such as KeePass databases, BitLocker keys, and AxCrypt-encrypted files).
  • Concurrent Vectors: Simultaneously, researchers noted the exploitation of CVE-2024-28000 in the WordPress LiteSpeed Cache plugin for privilege escalation, alongside XML-RPC brute-force attacks (brute_xmlrpc.py) and malware delivery campaigns leveraging social engineering tactics (ClickFix and concealed VBScript drops).

Affected Systems / Environments

The environments impacted by the reported incidents span multiple technological layers:

CVECategory (CWE)ImpactCVSSVector (Condensed)
CVE-2023-49105CWE-287 (Improper Authentication)Remote execution / File access9.8AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2024-28000CWE-266 (Incorrect Privilege Assignment)WordPress Privilege Escalation9.8AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-53362CWE-787, CWE-122 (Memory Corruption)Linux Kernel Memory Corruption7.8AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-66384CWE-22 (Path Traversal)Docker Cache Out-of-Path Write5.3AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
  • ownCloud Core: Versions 10.6.0 through 10.13.0.
  • WordPress LiteSpeed Cache: Versions up to and including 6.3.0.1.
  • Linux Kernel: Branches affected by accounting flaws in UDPv6 sockets using MSG_SPLICE_PAGES.
  • JFrog Artifactory Self-Managed: Versions impacted under specific remote repository conditions.

Mitigation and Detection

Remediation

  1. ownCloud Update: Immediately upgrade to patch version 10.13.1 or higher across all exposed ownCloud deployments.
  2. Signing Key Enforcement: Ensure all user accounts have an active and robust signing key configured to invalidate default empty pre-signed URL behavior.
  3. Ecosystem Patching: Update critical WordPress plugins (LiteSpeed Cache) and apply CISA guidelines for the Linux kernel and container solutions prior to established deadlines (August and September 2026).

Detection

Blue Teams should actively monitor WebDAV access logs for anomalous requests utilizing pre-signed URLs without standard session validation, alongside tracking the presence of automation scripts in temporary or public directories.

Early detection of user enumeration patterns against file interfaces and anomalous HTTP requests targeting WebDAV remains a primary defense line against cyberespionage campaigns targeting sensitive intellectual property.

bash 
# Example search for suspicious unauthenticated WebDAV access attempts in Apache/Nginx logs
grep -E "PROPFIND|GET" /var/log/apache2/access.log | grep -i "remote.php/webdav" | awk '{print $1, $7}' | sort | uniq -c | sort -nr

Wrapping Up

The weaponization of CVE-2023-49105 by cyberespionage actors to steal strategic information from nuclear and defense facilities in the Philippines underscores the urgency of strict patch management policies. The inclusion of these flaws in CISA’s KEV catalog emphasizes that web collaboration components and cloud storage remain prime targets for silent exfiltration of critical data.

References