ownCloud graphapi CVE-2023-49103 (phpinfo URL in a bundled library discloses environment variables such as admin password and mail/database credentials, CISA KEV): how do I fix it and which secrets do I rotate?

What it is: CVE-2023-49103 affects the 'graphapi' app of ownCloud Server. A third-party library bundled with it shipped a test file that shows PHP's phpinfo() page, which lists all of the web server's environment variables. In containerized deployments those often contain the ownCloud admin password, mail server credentials, database credentials and license key. ownCloud disclosed it in November 2023, mass scanning and exploitation followed within days, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-30. ownCloud stressed that just disabling the graphapi app does not remove the problem, because the file is still there. Am I affected: - ownCloud Server with the graphapi app 0.2.0 through 0.3.0 installed (fixed in 0.2.1 / 0.3.1 per NVD). Check the apps folder for apps/graphapi and its version in the admin Apps page. - Credential exposure mainly hits Docker/containerized deployments that pass secrets as environment variables; ownCloud notes its containers from before February 2023 weren't exposed to the credential leak, but phpinfo itself still leaks other system details. Fix: 1. Update the graphapi app to a fixed version (or remove the app if you don't use it), and delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php as ownCloud advises. 2. Disable PHP's phpinfo function on production servers (disable_functions in php.ini) as defense in depth; ownCloud did this in its own containers. 3. Rotate the secrets ownCloud lists: the ownCloud admin password, mail server credentials, database credentials and object-store/S3 access keys, plus anything else that was in the web server's environment. 4. Check web server logs for requests to the GetPhpInfo.php path, review admin accounts and sharing settings for unexpected changes, and update ownCloud Server itself to a current release. Verify: the GetPhpInfo.php file no longer exists, a request to that path returns 404, and the old credentials no longer work. Sources: https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/ https://nvd.nist.gov/vuln/detail/CVE-2023-49103 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49103