ownCloud CVE-2023-49105 WebDAV Bypass Used to Exfiltrate 372 MB of Philippine Nuclear Records

Hunt.io identified an exposed directory at 31.58.209[.]241 containing five custom scripts that generated valid WebDAV requests for known usernames without credentials when no signing key was set, the default state. The actor retrieved nuclear fuel inventories, 2023-2028 strategic plans, ZKTeco BioTime SQL dumps, BitLocker keys, and a KeePass database totaling 372 MB across five staging folders. CISA added the flaw to its KEV catalog days later after confirming active use against the target.

Technical evidence is limited to simplified Chinese strings in comments, docstrings, and folder names plus open-source tooling such as Sliver and Metasploit. No infrastructure or TTP overlap with known state groups has been published, so attribution stops at language markers. A parallel intrusion at a Philippine Navy supplier used CVE-2024-28000 on WordPress with an unrelated EtherHiding ClickFix loader still active in the same directory.

The pattern shows repeated targeting of default-configured collaboration platforms holding critical infrastructure data rather than sophisticated zero-days. ownCloud instances without explicit signing-key enforcement remain reachable by any actor who can enumerate usernames. Similar exposures likely exist in other national research and defense-adjacent networks that adopted the software between 10.6.0 and 10.13.0.

Operators should audit all ownCloud deployments for signing-key presence, rotate any exposed pre-signed URLs, and monitor for the specific script behaviors documented by Hunt.io. Additional Philippine and Southeast Asian research hosts using the same stack are probable next targets within the next quarter.