CVE-2023-49103:

Overview

Remediation

• Upgrade to fixed releases: update graphapi to 0.2.1 (0.2.x line) or 0.3.1 (0.3.x line), or move to a newer version that contains the fix.
• If upgrading is not feasible, apply mitigations:
• Remove or disable the phpinfo exposure path by patching the GetPhpInfo.php usage or eliminating the GetPhpInfo.php library from the deployment.
• Restrict access to any phpinfo-related endpoints (authentication, network access controls) or disable the endpoint entirely.
• If the exposed data could have been accessible, rotate all sensitive credentials exposed via environment variables (admin password, mail server credentials, license keys) and adopt secret management practices (e.g., Docker secrets, Kubernetes secrets) rather than passing credentials via env vars.
• Harden container security: use updated base images, limit environmental leakage, and implement network segmentation to reduce exposure of admin interfaces and configuration endpoints.
• Verify remediation:
• After applying the fix, confirm that the phpinfo endpoint no longer reveals environment details by attempting to access it and ensuring no sensitive data is disclosed.
• Perform a configuration review and credential audit to ensure no sensitive data remains exposed in environment variables or logs.
• General recommendations:
• Consider removing unnecessary graphapi functionality if it is not required for your deployment.
• Monitor for indicators of exploitation and apply patches promptly, given active exploitation observations in some environments.

References

• - [ownCloud Security](https://owncloud.org/security)
• - [Disclosure of Sensitive Credentials and Configuration in Containerized Deployments - ownCloud Security Advisory](https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/)
• - [CISA Known Exploited Vulnerabilities Catalog – CVE-2023-49103](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49103)