Skip to content

ownCloud CVE-2023-49105 exploited against a Philippine nuclear research body (Hunt.io)

Summary

Hunt.io (reported via The Hacker News, August 28, 2026) documented a deliberate intrusion in which a Chinese-speaking actor exploited CVE-2023-49105 — the ownCloud WebDAV pre-signed-URL authentication bypass listed in CISA KEV on August 27, 2026 — against an ownCloud instance run by a nuclear research body in the Philippines, and a second intrusion into a marine engineering / shipbuilding company that services the Philippine Navy. The ownCloud exfiltration is the first named, high-value victim of the August 27 KEV listing and closes the loop on why CISA added the 2023 CVE to the catalog with an August 30, 2026 BOD 26-04 deadline.

  • Primary flaw: CVE-2023-49105 (CVSS 9.8, CWE-287) — unauthenticated file access/modify/delete over WebDAV when the victim's username is known and that account has no signing key configured (the default). ownCloud "core" 10.6.0 → 10.13.0 affected; fixed in 10.13.1 (ownCloud Server; Infinite Scale and managed services not affected).
  • Actor: assessed Chinese-speaking from simplified Chinese in source-code comments, docstrings, log output, and the folder structure used to sort stolen data. Hunt.io is explicit that this is a language-based indicator, not a state-affiliation call.
  • Attribution posture: Hunt.io says the operator "whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations." No named cluster, no group label.

Tags

Hunt.io's findings

Exposed staging host

Hunt.io identified an open directory on host 31.58.209[.]241 that staged custom Python scripts, open-source offensive tooling (Sliver, Metasploit, Mettle), and exfiltrated data from two Philippine organizations (the nuclear research body and the marine-engineering/shipbuilding company).

ownCloud exfiltration (nuclear research body)

  • Five custom Python scripts on the host implement the CVE-2023-49105 exploit. An attacker who knows a valid username can construct signed WebDAV requests accepted as an authenticated action by that user, without ever supplying credentials.
  • The pre-signed URLs were generated with an empty signing secret.
  • Four of the five scripts target a single account each; the fifth enumerates the WebDAV directory and logs every download attempt.
  • Volume: an estimated 176 files totaling ~372 MB downloaded from the nuclear research entity, staged across five staging directories.
  • Exfiltrated material included: nuclear-material account records; draft strategic plans covering 2023–2028; research reactor core components; historical fuel inventories; presentation material; employee personal information; a 192 MB SQL dump of a ZKTeco BioTime attendance/personnel database; and credential stores (BitLocker keys, a KeePass database, and AxCrypt-encrypted files).

Secondary WordPress intrusion (marine engineering / shipbuilding)

  • Exploited a critical flaw in the LiteSpeed Cache plugin for WordPress (CVE-2024-28000, CVSS 9.8) to gain elevated access to the company's WordPress site.
  • A separate script, brute_xmlrpc.py, targeted the same site with an XML-RPC brute-force attack — an independent credential-guessing path parallel to the plugin exploit.
  • Unrelated, possibly active compromise found in the same WordPress source: EtherHiding, which extracts HTML content from an Ethereum smart contract and serves a Google verification page (a ClickFix-style lure). The lure launches pcalua.exe → mshta.exe to download a VBScript dropper. Hunt.io flags this as possibly an unrelated attacker.

Why this matters

  • This is the concrete, named-victim exploitation behind the August 27 KEV addition of CVE-2023-49105. CISA names no actor or infrastructure on the catalog entry; Hunt.io supplies the first public victim context.
  • Default configuration is the risk: the bypass requires only a known username and the absence of a signing key — the ownCloud default. Every unpatched sub-10.13.3 instance with default signing config is exposed.
  • The exfiltrated nuclear-material records and 2023–2028 strategic plans are a sector-critical data-theft outcome, and the parallel targeting of a Philippine Navy service provider aligns (per Hunt.io) with South China Sea interest — treat the two victims as a deliberate, multi-target campaign, not a one-off.
  • The secondary WordPress/CVE-2024-28000 / XML-RPC / EtherHiding layer is a separate, possibly unrelated intrusion and should be triaged on its own terms.

Defender priorities

  1. Patch ownCloud now. Upgrade ownCloud Server to ≥ 10.13.3 (or apply the subscription patch) and configure signing keys for WebDAV pre-signed URLs. FCEB agencies: apply by 2026-08-30 per BOD 26-04.
  2. Hunt for pre-signed-URL abuse: unauthenticated WebDAV GET/PROPFIND/MKCOL/PUT/DELETE with a known-username signature and an empty signing secret; log every download attempt and correlate to the five staging-directory pattern.
  3. Assume breach on the affected ownCloud instance: inventory what the exposed account could reach, review the ZKTeco BioTime / credential-store exposure, and rotate BitLocker / KeePass / AxCrypt credentials that were in the dump.
  4. Triage the WordPress side separately: patch LiteSpeed Cache (CVE-2024-28000), disable or protect XML-RPC, and hunt for the EtherHiding / Google-verification-page / pcalua.exe→mshta.exe→VBScript ClickFix chain — it may be an independent actor.
  5. Preserve evidence before cleanup (BOD 26-04 Forensics Triage applies to covered federal systems; apply the same discipline to the nuclear research body).

Assessment limits

  • The Chinese-speaking assessment is a language-based indicator (source-code comments, docstrings, logs, folder naming), not an attribution to a state or named group. Hunt.io explicitly withholds the state/contracted/independent distinction.
  • CISA's KEV entry for CVE-2023-49105 records ransomware use as unknown and names no actor, infrastructure, or payload; the actor/victim context on this page is Hunt.io's reporting only.
  • The EtherHiding / ClickFix WordPress compromise is flagged by Hunt.io as possibly unrelated; do not fold it into the ownCloud actor without corroboration.
  • 31.58.209[.]241 is the exposed staging host Hunt.io identified; treat it as an indicator, not a full threat-model anchor.

Sources