Server: Local file inclusion in core

Due to an improper control of the filename for a require_once() statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions.

Depending on the ownCloud configuration and the authentication state of a remote attacker this vulnerability may have different impact. Specifically:

• An unauthenticated remote attacker is able to reinstall the instance in case he is able to connect to a database or the SQLite driver is installed. This will overwrite the existing configuration and existing users will not be able to login anymore. This attack is very likely to be noticed, however an attacker is granted administrative access to the ownCloud instance. If a backup of the configuration file is accessible for the web server user the attacker might restore it after a successful exploitation to cover the attack
• An unauthenticated remote attacker is able to execute arbitrary PHP code if he is able to upload files using the public upload functionality and he can guess the full path of the folder.
• An authenticated remote attacker is able to execute arbitrary PHP code if the /data/ directory is below the ownCloud root. The directory can be moved using the datadirectory configuration in config/config.php.

ownCloud Inc. is currently not aware of any active attack that are exploiting this vulnerability. To verify whether your installation might have been attacked you can use the following regular expression: index.php\/[^ /]+\/[^ /]+\/[\.]+\/[\.]+\/. (e.g. cat /var/log/apache2/access_log | grep -i -E 'index.php\/[^ /]+\/[^ /]+\/[\.]+\/[\.]+\/*')

Please contact [email protected] if you have proof that you’ve been attacked using this vulnerability.

For more information please consult the official advisory.

This advisory is licensed CC BY-SA 4.0