CVE‑2023‑49103: ownCloud GraphAPI Information Disclosure Vulnerability
What It Is – The ownCloud GraphAPI endpoint GetPhpInfo.php can be invoked without authentication to return the output of PHP’s phpinfo(). The response includes configuration details and, in many deployments, plaintext administrative credentials.
Exploitability – No authentication is required; an attacker only needs to send a crafted HTTP GET request. Public proof‑of‑concept scripts are already circulating. The CVSS base score is 7.5 (High).
Affected Products – ownCloud GraphAPI (all versions that expose GetPhpInfo.php).
Why It Matters for Trust & Control Assurance
- Access control gaps – Unauthenticated exposure of admin secrets demonstrates a failure to enforce least‑privilege and proper authentication, a control area that underpins many frameworks (e.g., NIST CSF 2.0 PR.AC‑1).
- Audit‑ready evidence – Organizations must be able to prove that privileged endpoints are protected and that any deviation is logged and remediated, supporting continuous control monitoring.
- Supply‑chain confidence – Many enterprises rely on ownCloud as a collaboration platform; a breach in this component can cascade to downstream services, eroding the trust signal required in vendor assessments.
Recommended Actions
- Block or remove the
GetPhpInfo.phpendpoint from production web servers. - Enforce authentication on all GraphAPI calls and apply strict role‑based access controls.
- Audit logs for any access to
phpinfo()‑related URLs and retain evidence for at least 90 days. - Patch to the latest ownCloud release that removes the vulnerable endpoint, and verify the fix with a scanner.
- Update your control inventory to map this finding to the “Access Control” objective and capture remediation evidence for audit readiness.
Source: CISA KEV – CVE‑2023‑49103