Disclosure of files that begin with ".v" due to unchecked return value - ownCloud

Due to a incorrect usage of the getOwner function of the ownCloud virtual filesystem,done authenticated users with incoming shares of other users are able to access files beginning with “.v” of the sharing user. This can only be exploited if the “files_versions” application is enabled on the server.

Affected Software

• ownCloud Server < 8.2.2 (CVE-2016-1500)
  • core/b7c217290f0d1974c048bb467e2c3cee0bbc6fc2
• ownCloud Server < 8.1.5 (CVE-2016-1500)
  • core/51c6cd5c6a725b4849d995049163a0b87a9c3a58
• ownCloud Server < 8.0.10 (CVE-2016-1500)
  • core/07fb3e329b37c19d9eb6a3a114e00a09f3f2798b
• ownCloud Server < 7.0.12 (CVE-2016-1500)
  • core/f746100e13dcadf8a2b6d311422a1c66c959565c

Action Taken

The usage of getOwner has been corrected and ownCloud 9.0 will throw an exception in case the owner of an not existing file is requested.

Acknowledgements

The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:

• Lukas Reschke - ownCloud Inc. ([email protected]) - Vulnerability discovery and disclosure.