Local file inclusion on MS Windows Platform
Platform: ownCloud Server
Versions: 7.0.6, 8.0.4,
Risk level: High
CVSS v2 Base Score: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Due to an improper control of the filename for a
require_once() statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions when running on the MS Windows Platform.
Depending on the ownCloud configuration and the authentication state of a remote attacker this vulnerability may have different impact. Specifically:
- An unauthenticated remote attacker is able to reinstall the instance in case he is able to connect to a database or the SQLite driver is installed. This will overwrite the existing configuration and existing users will not be able to login anymore. This attack is very likely to be noticed, however an attacker is granted administrative access to the ownCloud instance. If a backup of the configuration file is accessible for the web server user the attacker might restore it after a successful exploitation to cover the attack
- An unauthenticated remote attacker is able to execute arbitrary PHP code if he is able to upload files using the public upload functionality and he can guess the full path of the folder.
- An authenticated remote attacker is able to execute arbitrary PHP code if the /data/ directory is below the ownCloud root. The directory can be moved using the datadirectory configuration in config/config.php.
- ownCloud Server < 7.0.6 (CVE-2015-4716)
- ownCloud Server < 8.0.4 (CVE-2015-4716)
The ownCloud Server component is now properly sanitizing characters to the affected routing component. Starting with ownCloud 8.1 it will not be possible anymore to run ownCloud Server on the MS Windows Platform.
The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:
- Lukas Reschke – ownCloud Inc. (firstname.lastname@example.org) – Vulnerability discovery and disclosure.