Kiteworks has acquired ownCloud reddit / selfhosted ---------------------------------------------------------------------- noblecloud · 2023-11-29 20:02 Odd timing... ---------------------------------------------------------------------- tankerkiller125real · 2023-11-29 20:07 Talk about shit timing, personally I would have delayed the announcement for like another month at least... ---------------------------------------------------------------------- A1994SC · 2023-11-29 20:10 Is there a reason you say that? Probably I'm just out of the loop ---------------------------------------------------------------------- tankerkiller125real · 2023-11-29 20:11 https://www.theregister.com/2023/11/27/three\_major\_vulnerabilities\_ in\_owncloud/ ---------------------------------------------------------------------- radialapps · 2023-11-29 20:19 EDIT: the two announcements were literally on the same day (11/21) https://owncloud.com/security-advisories/disclosure-of-sensitive- credentials-and-configuration-in-containerized-deployments/ ~~The acquisition post was on 11/21, the vulnerability disclosure was after that I believe. Still it's odd they're so close.~~ ---------------------------------------------------------------------- radialapps · 2023-11-29 20:22 Saw a couple of blog posts from Nextcloud relevant to this: https://nextcloud.com/blog/kiteworks-acquires-owncloud-dracoon/ https://nextcloud.com/blog/security-statement/ ---------------------------------------------------------------------- gnocchicotti · 2023-11-29 20:42 I really, really hope that is a coincidence and not something that was kept hidden from the buyers and customers until the ink dried on the acquisition paperwork. If it's the latter, there is going to be a hell of a legal fight and possibly criminal charges. ---------------------------------------------------------------------- radialapps · 2023-11-29 20:43 Read my mind ---------------------------------------------------------------------- the9engines · 2023-11-29 20:45 This is a pretty weird timing to be honest ---------------------------------------------------------------------- wrath_of_reaper · 2023-11-29 21:25 Pretty biased, and completely understandable from their point of view. But to be fair: NC has their high-score-vulns as well and the USD 10K bug bounty program is a joke - seriously. ---------------------------------------------------------------------- noseshimself · 2023-11-29 21:45 It's customary to publish obituaries when there is no way to hide that the corpse is dead indeed. The smell is a dead giveaway. ---------------------------------------------------------------------- VeryLongHairGuy · 2023-11-29 22:52 I’m a bit out of the loop, what and why it is an odd timing? ---------------------------------------------------------------------- lmm7425 · 2023-11-29 23:09 ownCloud just announced a 10/10 vulnerability and Kiteworks (formerly Accellion) was subject to a huge breach recently https://purplesec.us/accellion-data-breach-explained/ ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:11 They also bought Dracoon, another small competitor doing file sync&share. Seems US based Kiteworks (which makes file sync & share software themselves) is looking to get into the European self-hosted market. See also our blog - if you'd like to migrate, now's the time. https://nextcloud.com/blog/kiteworks-acquires-owncloud-dracoon/ ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:14 We have high score vulnerabilities - though none since a long time that would give you full access to user data without even needing an account because we didn't clean up test files. Anyhow, what's a joke about our bug bounty program? We pay out quite a significant amount of $$ every year there and do pretty well tracking the requests, seeing the statistics.. \`\`\` 5 hrs Average time to first response 3 months Average time to bounty 2 months Average time to resolution 100% of reports Meet response standards $81,993 Total bounties paid \`\`\` If that's a joke, it's an expensive one, both in terms of cash paid and the effort we put in... ---------------------------------------------------------------------- jospoortvliet · 2023-11-29 23:16 I'm obviously no ownCloud fan, but I doubt it's anything but a coincidence - such a take-over takes months to prepare, especially if you buy like 3 companies in a week like Kiteworks did there. And who on earth would intentionally leave a security vulnerability? I mean, maybe they want the customers to move to Kiteworks SUPER FAST and use 'bad security of ownCloud' as a reason, but darn, customers might just lose trust and move to, say, Nextcloud ;-) ---------------------------------------------------------------------- lmm7425 · 2023-11-29 23:20 Wonder what this means for open-source ownCloud and the new [OCIS](https://github.com/owncloud/ocis). ---------------------------------------------------------------------- TheCudder · 2023-11-29 23:30 For what it's worth, the vulnerability likely does not affect anyone in this sub, and it's actually due to a plugin. > Customers are urged to take the mitigation measures suggested by ownCloud: delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft- graph/tests/GetPhpInfo.php. This directory is most likely not even there. ---------------------------------------------------------------------- the-last-user · 2023-11-30 00:23 It *is* there (and the exploit can be performed) even if you haven't installed the plugin. ---------------------------------------------------------------------- LegitimateCopy7 · 2023-11-30 00:48 no, it's unfortunate timing. companies are not bought within a few days. all the preparation takes months at the minimum. ---------------------------------------------------------------------- eve-collins · 2023-11-30 01:17 Good thing I moved over to Nextcloud just recently I guess ---------------------------------------------------------------------- Revolutionary-Sea277 · 2023-11-30 01:30 admin@encompassonline.ca ---------------------------------------------------------------------- MixedLeaf · 2023-11-30 01:49 u/wrath_of_reaper The fact they have a bounty program is better than a lot. I also think that if someone has such high value items stored that a 10k max bounty is an issue, maybe they should look into contributing to increase bounty rewards. Working B2B is a collaboration, and if you have items you want to make sure are safe, communicate with your vendors. Don't expect a company like NextCloud to provide massive bounties to protect your data when they likely make nothing off you. ---------------------------------------------------------------------- sevlonbhoi1 · 2023-11-30 04:29 they are talking about the timing of announcement, not acquisition. ---------------------------------------------------------------------- Janpeterbalkellende · 2023-11-30 07:39 You know what makes you vulnerable, assuming your unlikely to be hit by a exploit ---------------------------------------------------------------------- mickael-kerjean · 2023-11-30 10:37 OCIS is quite an interesting software, if it doesn't get any love by kiteworks, I might take it under the Filestash umbrella as a nice storage backend. ---------------------------------------------------------------------- mickael-kerjean · 2023-11-30 10:39 OCIS is quite interesting, you see the kind of though that went onto its design and architecture compared to the old PHP version, if doesn't get any love from their new owner, I might take it under the Filestash umbrella ---------------------------------------------------------------------- VeryLongHairGuy · 2023-11-30 11:46 Indeed, it’s certainly a timing. Thanks ---------------------------------------------------------------------- TheCudder · 2023-11-30 12:22 Where are you getting this information specifically? I'm going off what OwnCloud has stated... > The vulnerability arises from a flaw in the "graphapi" app, present in ownCloud versions 0.2.0 to 0.3.0. This app utilizes a third-party library that will reveal sensitive PHP environment configurations, including passwords and keys. Disabling the app does not entirely resolve the issue, and even non-containerized ownCloud instances are at risk. Docker containers before February 2023 are not affected. > Mitigation information includes... * Delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft- graph/tests/GetPhpInfo.php. * Additionally, we disabled the phpinfo function in our docker-containers. * We also advise to change the following secrets: ownCloud admin password, Mail server credentials, Database credentials, Object- Store/S3 access-key It says if it's "disabled" it can still be exploited...nothing about exploiting it with the files mentioned not existing. Specifically the "GetPhpInfo.php" file within the "/tests" subdirectory. The other 2 vulnerabilities published are mitigated by running the latest versions of OwnCloud & OAuth (which those versions aren't exactly brand new either). ---------------------------------------------------------------------- weaseldum · 2023-11-30 13:32 This is misinformation. Unless you have manually installed the MS graphapi plugin, that file is NOT present. To date, there have been 866 downloads of that plugin. The vast majority of owncloud users are not vulnerable to this exploit. That said, it is horrible that such a vulnerability exists . It never should have happened. It makes me wonder what other crazy vulnerabilities I may be exposed to. I am contemplating a switch to different software. ---------------------------------------------------------------------- Scared_Bell3366 · 2023-11-30 13:32 Yes, it will work. You may have to set the SE side to 1G. I’m using a similar DAC cable from UI to go from a UDMP to a USW-24-PoE. ---------------------------------------------------------------------- the-last-user · 2023-11-30 14:05 > Where are you getting this information specifically? From your owncloud.com link and my ownCloud 10.10 installation. You stated "the directory is most likely not even there" which is factually incorrect as this directory (and the GetPhpInfo.php file) ships with ownCloud. > It says if it's "disabled" it can still be exploited...nothing about exploiting it with the files mentioned not existing. Understanding what you are referring to by "it" might be important here: "It" is "[Graph API](https://marketplace.owncloud.com/apps/graphapi)" which is an "app" that ships with ownCloud and can be "enabled" in the web UI. By default the Graph API app is in the "disabled" state, but this path and file still exist regardless of whether the app is "enabled" or "disabled" (as alluded to in your owncloud.com link). ---------------------------------------------------------------------- the-last-user · 2023-11-30 14:17 You are the one who is misinformed. I have never manually installed the ownCloud Graph API app, but this file WAS present in my ownCloud 10.10 installation **because it shipped with ownCloud**. In fact my ownCloud installation is currently complaining that "Some files have not passed the integrity check" specifically because I deleted this file for this app that was *never* "enabled". ---------------------------------------------------------------------- weaseldum · 2023-11-30 14:45 This is 100% false. I'm not sure what your intent is, but for those who actually run owncloud, you can read the cve, the post from owncloud, and you can determine if you are vulnerable. I went so far as to use the Linux find command and search my entire server looking for that file. It will only be there if you have installed the MS graphapi plugin, which is NOT installed by default. ---------------------------------------------------------------------- TheCudder · 2023-11-30 15:21 >From your owncloud.com link and my ownCloud 10.10 installation. You stated "the directory is most likely not even there" which is factually incorrect as this directory (and the GetPhpInfo.php file) ships with ownCloud. The vulnerability is specific to a GetPhpInfo.php file which would be located within owncloud/apps/graphapi/vendor/microsoft/microsoft- graph/tests/GetPhpInfo.php While the above path will exist within a default OwnCloud install, it will not by default include the "tests" sub-directory. It's my understanding that "tests" was mistakenly included/added by the developer of a third-party app/plugin, and that's where the vulnerability comes in. I could by mistaken on how it ended up there, but the "tests" folder & the "GetPhpInfo.php" file within it is the issue...not the entirely of GraphAPI. I have 2 OwnCloud instances running, one native and one Docker based....fortunately, neither has this "tests" sub-path by default.