Critical bug in ownCloud file sharing app exposes admin passwords reddit / selfhosted ---------------------------------------------------------------------- Plausibility_Migrain · 2023-11-24 22:42 Does this also affect NextCloud? ---------------------------------------------------------------------- YourFlakingFuture · 2023-11-25 00:11 More like ownedCloud ---------------------------------------------------------------------- Vangoss05 · 2023-11-25 02:31 Yes https://nvd.nist.gov/vuln/detail/CVE-2023-48239 ---------------------------------------------------------------------- Orkahmrust · 2023-11-25 04:25 If you’re running the latest version of Nextcloud (27.1.3) this is already patched. ---------------------------------------------------------------------- thm · 2023-11-25 06:02 This has nothing to do with the owncloud exploit. ---------------------------------------------------------------------- jbiz143 · 2023-11-25 07:02 Has anyone found a reference for which ownCloud versions are affected/patched? Recent release notes don’t mention these vulnerabilities. ---------------------------------------------------------------------- jbiz143 · 2023-11-25 07:25 Does anyone know which version of OwnCloud is patched? e.g 10.13.0 ---------------------------------------------------------------------- Varnish6588 · 2023-11-25 09:10 is this for the PHP version or the new Golang version? ---------------------------------------------------------------------- slykethephoxenix · 2023-11-25 11:37 pwnedCloud ---------------------------------------------------------------------- persiusone · 2023-11-25 15:32 This is why it's important to have other security monitoring resources on your network if you intend to open ports or expose your services to the Internet. Also a good time to change all your passwords if you have not already. ---------------------------------------------------------------------- outtathesky_fellapie · 2023-11-25 16:40 And you should be using a VPN to access your network, not opening ports ---------------------------------------------------------------------- persiusone · 2023-11-25 16:44 Yes ---------------------------------------------------------------------- -Brownian-Motion- · 2023-11-26 07:02 Nextcloud 27.1.3 is patched. ---------------------------------------------------------------------- Discommodian · 2023-11-27 04:23 Or a reverse proxy. It kills a lot of the functionality of ownCloud to limit access to only vpn. I couldn’t really share links with family. ---------------------------------------------------------------------- augmented-garage · 2023-11-28 18:10 PHP ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-07 15:46 Unless you have a clientless VPN/zero trust overlay network so that you can easily share and get superior security benefits. ---------------------------------------------------------------------- freestylemaster · 2023-12-29 07:00 Would you kind suggesting some options? ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-29 12:32 Several commercial versions do anything from PAC file, DNS intercepts, or browser plugins (e.g., Zscaler, Fortinet, etc). Another option is the open source project I work on called OpenZiti. Its an zero trust overlay network with endpoints for almost anything. One of these is called 'browZer' - [https://blog.openziti.io/introducing-openziti- browzer](https://blog.openziti.io/introducing-openziti-browzer). It provides a 'clientless' user experience while the application(s) sit in a private network making outbound-only connections. This is achieved by the user logging into their IdP of choice (e.g., Google) and Ziti side loads an endpoint into the users browser tab without them realising. ---------------------------------------------------------------------- freestylemaster · 2023-12-29 16:40 Very interesting, thanks!