ownCloud vulnerability with maximum 10 severity score under “mass” exploitation reddit / selfhosted ---------------------------------------------------------------------- LordOthello · 2023-11-29 03:48 [ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation | Ars Technica](https://arstechnica.com/security/2023/11/owncloud- vulnerability-with-a-maximum-10-severity-rating-comes-under-mass- exploitation/) "The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL" ---------------------------------------------------------------------- guchdog · 2023-11-29 04:46 They talked about this on Security Now here is it is. [https://youtu.be/LYmR7DE5\_ak?si=hjtWxTzLmS10pDPy&t=3534](https://you tu.be/LYmR7DE5_ak?si=hjtWxTzLmS10pDPy&t=3534) ---------------------------------------------------------------------- idreamofjeanshorts · 2023-11-29 05:24 OwnedCloud. Thank you, thank you. ---------------------------------------------------------------------- idreamofjeanshorts · 2023-11-29 05:25 Might be wise to use Authelia in front of any web apps as an extra layer. ---------------------------------------------------------------------- Kingblesser616 · 2023-11-29 06:19 I upvoted you. I'm just glad you didn't go with pwnCloud. ---------------------------------------------------------------------- IdiocracyToday · 2023-11-29 06:25 Does this affect Nextcloud? ---------------------------------------------------------------------- darkcyde_ · 2023-11-29 06:32 Oof size: LARGE. ---------------------------------------------------------------------- martinjh99 · 2023-11-29 07:09 Does this pertain to Nextcloud as well?? I would think it might... ---------------------------------------------------------------------- WhittledWhale · 2023-11-29 07:16 https://help.nextcloud.com/t/do-the-recent-owncloud-cve-also-affect- nextcloud/175203 ---------------------------------------------------------------------- NeonGrillz · 2023-11-29 07:16 No, but Nextcloud has another vulnerability. Check CVE-2023-48239. Attackers can lock you out of your own files. ---------------------------------------------------------------------- WhittledWhale · 2023-11-29 07:16 https://help.nextcloud.com/t/do-the-recent-owncloud-cve-also-affect- nextcloud/175203 ---------------------------------------------------------------------- martinjh99 · 2023-11-29 07:16 Thanks ---------------------------------------------------------------------- jovialfaction · 2023-11-29 07:19 That's why I keep nextcloud behind http basic auth. Don't trust those software to expose them directly to Internet. ---------------------------------------------------------------------- ShapeShifter499 · 2023-11-29 07:52 This would prevent nextcloud sync and phone apps from proper access wouldn't it? ---------------------------------------------------------------------- DryPhilosopher8168 · 2023-11-29 07:56 I can't stress this enough, keep your private and enterprise cloud behind a vpn. Especially if you are a part time Admin with limited resources. Sooner or later you will be hacked. ---------------------------------------------------------------------- sebasdt · 2023-11-29 07:59 Yes but then use a vpn to access it. Only allow local Access. ---------------------------------------------------------------------- amarao_san · 2023-11-29 08:17 `POST /api/admin/unauthorized_sudo` Oh, no, it's PhpGetInfo.php, sorry, my bad. ---------------------------------------------------------------------- ShapeShifter499 · 2023-11-29 08:24 What if I like being able to share files with friends, some of whom don't know how or can't use a VPN? Are you saying there's no hope to secure a nextcloud setup that's trying to be a drop in replacement for google drive? ---------------------------------------------------------------------- Silencer306 · 2023-11-29 08:29 You decide if your data is worth the risk ---------------------------------------------------------------------- Silencer306 · 2023-11-29 08:30 Like Authelia? ---------------------------------------------------------------------- Silencer306 · 2023-11-29 08:31 Can something like Authelia protect your server against this? ---------------------------------------------------------------------- Silencer306 · 2023-11-29 08:31 So like a wireguard and Authelia? ---------------------------------------------------------------------- ShapeShifter499 · 2023-11-29 08:35 Well, I just had a thought, maybe it might be better to have two setups. One for shared data with a separate computer and drives, whatever cheap but still capable stuff. Nothing fancy as it's just going to mostly be duplicate data. One that sits behind VPN for all of the data I care about, this one gets the RAID setup and backup to a separate off-site cloud encrypted. ---------------------------------------------------------------------- DryPhilosopher8168 · 2023-11-29 08:38 There is but at the risk of being hacked. I think if you keep your setup up to date the chances are low. Still nextcloud and owncloud had absurd security flaws in the past. Maybe use something with a better track record. ---------------------------------------------------------------------- sonny4redit · 2023-11-29 08:42 Ist this also affecting ownCloud OCIS as well? ---------------------------------------------------------------------- RephRayne · 2023-11-29 09:19 https://en.wikipedia.org/wiki/DMZ_(computing) ---------------------------------------------------------------------- SenatorBagels · 2023-11-29 09:54 Bro, chill with the Authelia comments. ---------------------------------------------------------------------- azukaar · 2023-11-29 10:12 The issue is that web forms in front of apps kill mobile app support The next best thing is vpm-only access ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-11-29 10:25 Then you need to place this behind an actively WAF, hopefully.Cloudflare or Imperva would be able to filter these attacks... ---------------------------------------------------------------------- hamiwin · 2023-11-29 10:27 That’s soooo fucked up. It’s also the toppest concern for me when I self host. So I try to expose as few services as possible, and for non-privacy-sensitive stuffs, I just use whatever convenient public cloud. ---------------------------------------------------------------------- daYMAN007 · 2023-11-29 10:39 Yes ---------------------------------------------------------------------- moontear · 2023-11-29 11:01 No they don’t? It depends on the mobile app for sure, but I happily have authelia in front of the Nextcloud app. Get an authentication popup once and then I am in - also on mobile. It is just the web apps that need to support oauth. If they don’t support that, then you are correct it sucks with another form and no SSO (looking at you Homeassistant). ---------------------------------------------------------------------- azukaar · 2023-11-29 11:29 That's OAuth not webform auth as my message mentioned ---------------------------------------------------------------------- LuckyHedgehog · 2023-11-29 11:49 Basic auth is better than no auth, but it is absolutely not a recommended auth method these days ---------------------------------------------------------------------- Guizmo666th · 2023-11-29 12:09 Suggestions? ---------------------------------------------------------------------- Yosyp · 2023-11-29 12:10 I don't know what it is but now I don't want to know. Is it worth to have a look or the guy is just promoting bad stuff? ---------------------------------------------------------------------- bityard · 2023-11-29 12:20 Not sure what the drama here is about, but Authelia itself is fine. (It's an authentication app.) ---------------------------------------------------------------------- t_sawyer · 2023-11-29 12:22 Pick your poison lol https://www.bleepingcomputer.com/news/google/google-drive-users-angry- over-losing-months-of-stored-data/ ---------------------------------------------------------------------- User5281 · 2023-11-29 12:23 This is a case where you either lock it down or live with the risk. ---------------------------------------------------------------------- Crafty-Run-6559 · 2023-11-29 12:26 Just use tailscale. It makes it a breeze and you can invite other people to it. ---------------------------------------------------------------------- Noob_l · 2023-11-29 12:33 is nextcloud affected? ---------------------------------------------------------------------- Ystebad · 2023-11-29 13:33 Yes hello, I’d like to biggie size my oof ---------------------------------------------------------------------- Ystebad · 2023-11-29 13:35 Asked and answered like 4 times already. Links above. ---------------------------------------------------------------------- Noob_l · 2023-11-29 13:38 Yeah I saw after I commented but at the same time: how can we be sure. It's a devastating exploit and having someone on stack exchange just comment "No it doesn't affect nextcloud" isn't the most reassuring thing ---------------------------------------------------------------------- hypercyanate · 2023-11-29 14:18 This is why I don't expose anything other than my wireguard on my network ---------------------------------------------------------------------- HoustonBOFH · 2023-11-29 15:10 Hard to tell from the article, but it looks like it is only an issue if you added a specific addon. But it is not clear which addon. And no local test code... ---------------------------------------------------------------------- the-last-user · 2023-11-29 15:12 Thanks, OP. Now if only I could figure out how to change the SQLite database password in ownCloud 10.10 (it's not stored in config.php, but there is a "passwordsalt" configured there). ---------------------------------------------------------------------- SenatorBagels · 2023-11-29 15:15 Authelia is fine, alternatives exist such as Authentik. He's just been commenting about it constantly. I'm not saying he's astroturfing like Tailscale do, but he doesn't need to ask the same thing many times. ---------------------------------------------------------------------- pastudan · 2023-11-29 15:30 Also worth noting here: Exposing wireguard is quite safe because the daemon doesn’t even respond unless it recognizes your key. It just drops the UDP packet otherwise. Nothing is unhackable, but this is damn near close. Such a brilliant design. ---------------------------------------------------------------------- CoffeeCapy · 2023-11-29 15:32 To my understanding, OCIS is a complete rewrite of OwnCloud and was written in Go. So my intuition tells me it's not but I could be wrong. ---------------------------------------------------------------------- moontear · 2023-11-29 15:33 Uhm... pretty much all of my apps support OAuth / OpenID. And the app we are talking about here is OwnCloud which fully supports OAuth: [htt ps://doc.owncloud.com/server/next/admin\_manual/configuration/server/s ecurity/oauth2.html](https://doc.owncloud.com/server/next/admin_manual /configuration/server/security/oauth2.html) I'm not against your point that "web forms in front of apps kill mobile app support" - but in this particular case (OwnCloud) you CAN put Authelia in front of it without killing mobile app support. In other cases for other apps as well. I do agree that there are some apps (Homeassistant as I mentioned) that don't support OAuth, but support is getting better and better. ---------------------------------------------------------------------- Evantaur · 2023-11-29 15:59 How is someone on Reddit saying "no" any different? ---------------------------------------------------------------------- urglfloggah · 2023-11-29 16:04 For file sync, Seafile is great! I have been running it for years without any problems. ---------------------------------------------------------------------- jovialfaction · 2023-11-29 16:08 I use it on top of nextcloud auth ---------------------------------------------------------------------- Silencer306 · 2023-11-29 16:15 Just wanted to ask a question, sorry for asking multiple times. Im just starting out so still learning about stuff, as you can see from my post/comment history ---------------------------------------------------------------------- LuckyHedgehog · 2023-11-29 16:34 Basic auth is a base64 of your login credentials, might as well be plain text. You should absolutely not be using basic auth if you have other options ---------------------------------------------------------------------- OppositeFisherman89 · 2023-11-29 16:36 Shh bro, you might remind them that we haven't had our hourly "tailscale is awesome" post ---------------------------------------------------------------------- jovialfaction · 2023-11-29 16:45 I would agree if basic auth was my only auth, but I'm using it as a layer before getting to the nextcloud auth page. It ensures none of those 0 day vulnerability can be exploited on my instance. Traffic is https encrypted so even tho basic auth's password is not secure, it's not like it's in clear over the wire. My concern is less about being targeted in a MITM attack and more about random bots finding nextcloud public instances and attempting all sorts of exploits ---------------------------------------------------------------------- _pyrex · 2023-11-29 16:47 I vouch for Seafile. It has been my Dropbox replacement since 2018. Hosting it on a raspberry pi. ---------------------------------------------------------------------- LuckyHedgehog · 2023-11-29 17:03 Whether you are fine with the risk or not doesn't not make it a good idea. There is a reason the industry is moving away from even having it as an option. ---------------------------------------------------------------------- azukaar · 2023-11-29 17:16 Original comment is about ANY app And good for you but OpenID support is only in 5% of the top selfhosted applications ---------------------------------------------------------------------- JaggedPolygon1900 · 2023-11-29 18:53 I’d have given pwnCloud an upvote. I’m a simple man. ---------------------------------------------------------------------- one-joule · 2023-11-29 20:29 Backups are a solid mitigation. ---------------------------------------------------------------------- gnocchicotti · 2023-11-29 20:38 That's cool. ---------------------------------------------------------------------- trexxeon · 2023-11-29 20:41 Your intuition is right. Does not affect oCIS ---------------------------------------------------------------------- techcode · 2023-11-29 20:48 TL;DR: So how much is CloudFlare WAF better than it's basic/free plan set to "I'm under attack" and such? I'm playing with running some stuff on spare box at home, and with free ClouldFlare set to highest (I'm under attack) setting, each of these scanners previously managed to make CloudFlare think it's a real human/browser (as in even my own requests from same IP/box that CF points to and I'm re-checked every 30 minutes). And here's a snippet where I've cut out stuff that was not interesting at all (e.g. my own requests), and there was a bunch more of requests for/with things like mstshash=Administr, hudson ...etc. `xxx - - [25/Nov/2023:18:27:32 +0000] "CONNECT pro.ip-api.com:443 HTTP/1.1" 400 154 "-" "-"` `xxx - - [25/Nov/2023:19:44:20 +0000] "GET / HTTP/1.1" 400 154 "-" "-"` `xxx - - [25/Nov/2023:20:05:45 +0000] "GET / HTTP/1.1" 200 211 "-" "-"` `xxx - - [25/Nov/2023:20:13:13 +0000] "POST /boaform/admin/formLogin HTTP/1.1" 405 154 "http://ZZZZ:80/admin/login.asp" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"` `xxx - - [25/Nov/2023:20:13:13 +0000] "" 400 0 "-" "-"` `xxx - - [25/Nov/2023:20:43:35 +0000] "CONNECT google.com:443 HTTP/1.1" 400 154 "-" "-"` Those few OK/200s were me paying (turning on/off) redirecting them to websites like [https://www.lingscars.com/](https://www.lingscars.com/). ---------------------------------------------------------------------- Themis3000 · 2023-11-29 21:39 You could put nextcloud behind a reverse proxy with an authentication system in front of it. Users would need to login twice, once for your oauth portal then once for nextcloud. It would prevent anyone who doesn't have the first set of credentials from even interacting with nextcloud at all ---------------------------------------------------------------------- chevereto · 2023-11-29 22:32 I'm surprised that ownCloud didn't use a single PHP entrypoint. In PHP software you must restrict access to .php files, that's front controller basis. They really did bad and I'm very disappointed. ---------------------------------------------------------------------- pentesticals · 2023-11-29 23:00 Honestly, all applications are vulnerable AF, especially the open source projects without a major team behind them. I work in a security research team and we find critical bugs like this in a weekly basis. Even in major projects which you would be scared to know about. I personally wouldn’t expose anything except SSH or a VPN, or if I have to expose a web app, it’s going inside a VLAN with very restrictive firewall rules, proper logging, and a reverse proxy enforcing authentication via an OIDC based IDP. We generally spend a couple of days to a week before finding something critical allowing RCE. ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:26 Well, kind of. A authenticated user can break the system-wide external storage configuration. So IF a user is malicious AND you use external storage, you should update - the update has been out for 4 weeks, so that's not too hard. I wouldn't say it's comparable, but of course Nextcloud has security issues - any software does. That's why we run a [bug bounty program](https://hackerone.com/nextcloud)... Where we paid out over 80K USD, and have an average 5h response time as of now - we take it serious. See also [our statement](https://nextcloud.com/blog/security- statement/)on the ownCloud (now Kiteworks) issue. ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:26 Given it's owned by Kiteworks now, OwnedKite? FlyingKite? Hum, I'm not terribly good at this... :/ ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:27 I have heard nothing positive about it's security. It isn't heavily developed and doesn't really do CVE's... It's your choice, but I'd look for something with at least a serious bug bounty program. ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:28 See also https://nextcloud.com/blog/security-statement/ ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:29 How about: [https://nextcloud.com/blog/security- statement/](https://nextcloud.com/blog/security-statement/) So we say, NOPE. We remove test files from libraries we ship :/ You know, security hygiene. Anyhow, if there'd be an issue, somebody would get paid - see https://hackerone.com/nextcloud ---------------------------------------------------------------------- auzzlow · 2023-11-30 02:00 "Hacks like this are why I keep everything behind my TAILSCAAAALE VPN!" "OMG you haven't heard? It's not like a normal VPN... I connects you to your OWN devices!!" ---------------------------------------------------------------------- Wreid23 · 2023-11-30 02:49 WAF + sso setup if you must and some sort of fail2ban or crowdsec on the waf or containers. Some basic alerts / logging to know what's happening would be a good start. Also making sure the services are running encrypted traffic or even better proxied and encrypted traffic with valid certs. Ultimately only exposing as needed (vpn) or never exposing at all will always be the echo chamber as its just safer ---------------------------------------------------------------------- Wreid23 · 2023-11-30 03:17 Could also go passkey / mfa token on top of that in either the sso or next cloud or both for even more onion layers ---------------------------------------------------------------------- Illeazar · 2023-11-30 04:05 Oof size: 10 (maximum oof size) ---------------------------------------------------------------------- bruderbarnabas · 2023-11-30 05:14 For a simple Dropbox replacement, so mainly file synchronization, Inwould go for resilio sync or syncthing.