ownCloud Flaw Used to Steal Nuclear Data in the Philippines

The U.S. agency CISA has added a critical ownCloud vulnerability to its Known Exploited Vulnerabilities catalog — following reports that it was used in a real-world attack against a Philippine nuclear research facility.

The flaw in question is CVE-2023-49105 (CVSS 9.8) — an authentication bypass in the WebDAV API. Under default settings, when a user has no signing key configured, an attacker who knows someone else's username can craft signed WebDAV requests that the server accepts as actions by that user — reading, modifying or deleting any files without any password at all. ownCloud disclosed the issue back in November 2023; it affects “core” versions 10.6.0 through 10.13.0 and is fixed in 10.13.1.

An open directory gave the attackers away

Hunt.io discovered an unsecured directory on the host 31.58.209[.]241 that held custom-written Python scripts, well-known offensive tools (Sliver, Metasploit, Mettle) and data already stolen from two Philippine organizations — the nuclear center and a marine engineering and shipbuilding company that serves the country's navy.

Five scripts implemented the CVE-2023-49105 exploit: they generated pre-signed links with an empty signing secret and pulled files down over WebDAV. Four of the scripts each worked a single account, while the fifth crawled the directory and logged every download. In all, roughly 176 files totaling around 372 MB were siphoned out of the nuclear facility.

Among the stolen material were nuclear materials accounting records, drafts of strategic plans for 2023–2028, data on core components of the research reactor, fuel inventory history, presentations, employees' personal data, a 192 MB dump of a ZKTeco BioTime attendance database, and password stores as well — BitLocker keys, a KeePass database and encrypted AxCrypt files.

A Chinese trail and a second target

A parallel attack targeted the shipbuilding company's WordPress site: it exploited a critical vulnerability in the LiteSpeed Cache plugin (CVE-2024-28000), while a separate script, brute_xmlrpc.py, brute-forced passwords via XML-RPC. Researchers attribute the work to a Chinese-speaking operator — based on comments, docstrings and folder names in simplified Chinese. They tie the interest in a navy-linked firm to the current tensions in the South China Sea.

U.S. federal civilian agencies have been ordered to apply the patch by August 30, 2026. On the same day, CISA added two more vulnerabilities to the catalog — in the Linux kernel and in Artifactory: by OpenAI's own admission, they were exploited by its own AI agents against the company's internal infrastructure.

Source: The Hacker News