ownCloud graphapi CVE-2023-49103: phpinfo Credential Leak

What to do

1. Check every ownCloud Server for the graphapi app and its version with occ app:list.
2. Delete apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php wherever it exists and update graphapi to 0.3.1 or later.
3. Upgrade ownCloud Server to a current release (10.16.6 or 11.0.1); on Docker, pull a current image and recreate the container.
4. Add phpinfo to PHP's disable_functions list.
5. If a vulnerable server was reachable from the internet, rotate the admin password, mail, database and object-store/S3 credentials and any other secret in its environment.

How to check if you are affected or compromised

• Search web server access logs for GetPhpInfo.php requests that returned HTTP 200 with a non-zero body; attempts against Docker installs often append a suffix such as /.css.
• After any successful hit, review ownCloud admin logins and new admin accounts from that date onward.
• Check mail, database and S3 access logs for use of the leaked credentials from unfamiliar addresses.
• Test from outside that the GetPhpInfo.php URL, with and without /.css, no longer returns 200.

What happened#

On November 21, 2023, ownCloud published an advisory for its graphapi app, an add-on for the classic PHP ownCloud Server. The app bundled a third-party Microsoft Graph library whose test folder contained GetPhpInfo.php, a script that calls PHP's phpinfo(). Anyone could request it without logging in. The output includes all of the web server's environment variables. In containers, the advisory says, these "may include sensitive data such as the ownCloud admin password, mail server credentials, and license key." ownCloud warns that disabling the app does not eliminate the flaw.

The CVE record lists graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1, with a CVSS 3.1 score of 10.0. NVD scores it 7.5, as confidentiality-only. Exploitation began within days. The Record reported that GreyNoise saw attacks from November 25 from at least 12 IP addresses, and that Shadowserver counted more than 11,000 exposed ownCloud IPs. Rapid7 found that early exploits failed against Docker installs, which answered with a redirect, and that appending a segment such as /.css got past the Apache rewrite rules. It saw attempts in at least three customer environments. CISA added the CVE to the KEV catalog on November 30, 2023.

Who is affected#

Self-hosted ownCloud Server with graphapi 0.2.0 through 0.3.0. According to Rapid7, the official Docker images include graphapi by default from February 2023 onward, while manual installs do not. Docker setups commonly pass OWNCLOUD_ADMIN_USERNAME and OWNCLOUD_ADMIN_PASSWORD as environment variables, so one request could hand over an admin login. ownCloud says containers created before February 2023 are not vulnerable to the credential leak. Its December 1, 2023 notice says Infinite Scale and managed services, including ownCloud.Online, are not affected.

Do you really need to act?#

Most teams fixed this in 2023, so check exposure. Two points still matter. First, the leak is a one-time read. An attacker who pulled your phpinfo page in late 2023 may still hold working passwords if nobody rotated them, and updating the app does not revoke them. Second, a server still on graphapi 0.3.0 is probably also on an old ownCloud core. That leaves it open to CVE-2023-49105, the WebDAV pre-signed URL bypass disclosed the same day, which CISA added to KEV on August 27, 2026.

What to do now#

1. Check each server: sudo -u www-data php occ app:list | grep -i graphapi, or docker exec <container> occ app:list | grep -i graphapi on Docker.
2. Run find / -name GetPhpInfo.php -path '*graphapi*' 2>/dev/null, delete any hit, and update graphapi to 0.3.1 or later.
3. Upgrade ownCloud Server to a current release. The changelog lists 10.16.6 and 11.0.1. On Docker, pull a current image and recreate the container.
4. Add phpinfo to disable_functions in php.ini, as Rapid7 recommends.
5. If a vulnerable server was reachable from the internet, rotate the admin password and the mail, database and object-store/S3 credentials, as ownCloud advises, plus any other secret in the container environment.

How to tell if you were hit#

• Search access logs: zgrep -h 'GetPhpInfo.php' /var/log/apache2/access.log* | awk '$9 == 200'. Rapid7 says a 200 means success, a 404 or 302 means failure, and a zero-length body means phpinfo was disabled. Docker attempts often carry a suffix such as /.css.
• After any successful hit, review ownCloud admin logins and new admin accounts from that date onward.
• Check mail, database and S3 logs for use of the leaked credentials from unfamiliar addresses.
• From outside, confirm curl -s -o /dev/null -w '%{http_code}\n' https://cloud.example.com/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.css no longer returns 200.

Timeline#

• Nov 21, 2023 — ownCloud publishes the advisory, and the CVE is published.
• Nov 25, 2023 — GreyNoise sees exploitation begin.
• Nov 30, 2023 — CISA adds CVE-2023-49103 to KEV.
• Dec 1, 2023 — ownCloud tells customers to update graphapi to 0.3.1 and the server to 10.13.3. Rapid7 publishes the /.css bypass.
• Dec 21, 2023 — Federal remediation deadline.
• Aug 27, 2026 — CISA adds the sibling CVE-2023-49105 to KEV.

Vulnerability records

• CVE-2023-49103 · KEV 2023-11-30 · An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. ownCloud — Disclosure of sensitive credentials and configuration in containerized deployments owncloud.com
2. ownCloud — Immediate action required: critical security updates for ownCloud owncloud.com
3. ownCloud — Server changelog owncloud.com
4. CVE record — CVE-2023-49103 cve.org
5. NVD — CVE-2023-49103 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2023-49103 cisa.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2023-49105 cisa.gov
8. Rapid7 — ETR: CVE-2023-49103: Critical Information Disclosure in ownCloud Graph API rapid7.com

Coverage and analysis

1. The Record — Experts warn of critical ownCloud vulnerability being exploited therecord.media
2. BleepingComputer — Hackers start exploiting critical ownCloud flaw, patch now bleepingcomputer.com