Server: Local Path Disclosure when using Asset Pipeline

ownCloud 7 introduced the so-called “Asset Pipeline”. It is disabled by default, but can be enabled by setting asset-pipeline.enabled to true in config.php

When the setting is enabled ownCloud concatenates all CSS and JS files into a single large blob file. Thus the amount of initial required requests to the ownCloud instance is lower and therefore the instance is loaded faster.

The generated files are stored on the local filesystem and use a filename that is generated by hashing the original CSS and JS absolute file paths using MD5.

Therefore, an attacker could perform a brute-force attack to gain the information under which path (e.g. /var/www/owncloud/) the ownCloud instance was installed.

For more information please consult the official advisory.

This advisory is licensed CC BY-SA 4.0