ownCloud Flaw Exploited: Chinese Hackers Steal Philippine Nuclear Data

CISA has added a critical ownCloud vulnerability, tracked as CVE-2023-49105 with a CVSS score of 9.8, to its Known Exploited Vulnerabilities (KEV) catalog following confirmation that a Chinese-speaking threat actor weaponized the flaw to target a Philippine nuclear research body. The vulnerability is a WebDAV API authentication bypass that permits attackers to access, modify, or delete arbitrary files without credentials, provided the victim's username is known and the instance retains its default empty signing-key configuration. Disclosed in November 2023, the flaw affects ownCloud core versions 10.6.0 through 10.13.0 and was remediated in version 10.13.1.

Threat intelligence firm Hunt.io uncovered an open directory on the host 31.58.209[.]241, which contained custom Python scripts alongside offensive security tooling such as Sliver, Metasploit, and Mettle. The actor generated pre-signed WebDAV URLs with an empty signing secret to retrieve files from the nuclear research body's ownCloud instance without authentication, while a parallel intrusion targeted a WordPress site operated by a marine engineering and shipbuilding firm serving the Philippine Navy. Attribution to a Chinese-speaking operator was based on the presence of simplified Chinese in source code comments, docstrings, log output, and folder names used to organize exfiltrated data. Defenders investigating similar infrastructure can run a WHOIS lookup on suspicious staging IPs and use a port scanner to identify exposed ownCloud endpoints.

Five custom Python scripts in the exposed directory implemented the CVE-2023-49105 exploit, with four targeting single accounts and a fifth enumerating WebDAV directories while logging every download attempt. The actor is estimated to have exfiltrated 176 files totaling approximately 372 MB across five staging directories, including nuclear-material account records, draft strategic plans spanning 2023–2028, research reactor core component documentation, historical fuel inventories, employee personal information, a 192 MB SQL dump from a ZKTeco BioTime attendance and personnel database, and credentials stores. Given the breadth of credential exposure in this campaign, security teams should rotate any secrets tied to affected systems and validate new passwords with a password checker.

Given the nuclear-sector targeting, evidence of credential theft, and confirmed active exploitation, defenders should immediately patch ownCloud to version 10.13.1 or later, audit WebDAV access logs for anomalous unauthenticated retrieval patterns, and confirm that a non-default signing secret is enforced across all instances.