own Cloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
Summary: CISA added CVE-2023-49105, a WebDAV API authentication bypass in ownCloud core versions 10.6.0 through 10.13.0 with a CVSS score of 9.8, to its KEV catalog after Hunt.io reported a Chinese-speaking threat actor used it against a Philippine nuclear research body. Hunt.io found an open directory on host 31.58.209[.]241 staging custom Python scripts and tools including Sliver, Metasploit and Mettle, and estimated the actor downloaded 176 files totaling about 372 MB from the nuclear entity, including nuclear-material account records, research reactor core components, a 192 MB SQL dump of a ZKTeco BioTime database, BitLocker keys and a KeePass database.
What's compelling: The flaw needs only a valid username and the default no-signing-key configuration to read, modify or delete any file, and the stolen material included reactor core components and fuel inventories alongside credential stores - a combination that turns one unpatched ownCloud instance into both an intelligence loss and a foothold.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-49105CVE-2024-28000
- Related
- CVE-2023-49105: own Cloud Improper Authentication Vulnerability Known Exploited Vulnerabilities · Aug 27, 2026