Threat Overview
CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities catalog on August 27, 2026 after reporting tied the flaw to a targeted intrusion against a Philippine nuclear research organization. The vulnerability affects ownCloud Server 10 WebDAV authentication. If an attacker knows a valid username and the account does not have a signing key configured, crafted pre-signed WebDAV requests can be accepted without the user's password.
Public reporting linked the intrusion to infrastructure at 31.58.209.241 and described five custom Python exploit scripts found alongside Sliver, Metasploit, and Mettle tooling. The actor reportedly downloaded 176 files totaling approximately 372 MB. Simplified Chinese found in scripts, logs, and directory names supports a Chinese-speaking operator assessment, but state sponsorship was not confirmed.
The core risk is unauthorized file access rather than a generic endpoint RCE. Detection should therefore emphasize WebDAV request behavior, new/rare sources, high-volume file retrieval patterns, suspicious access to sensitive file types, and the confirmed staging IP where relevant telemetry is ingested.
References
- ownCloud Security Advisory — WebDAV API authentication bypass using pre-signed URLs
- CISA Known Exploited Vulnerabilities Catalog
- The Hacker News — ownCloud exploitation coverage — August 28, 2026
Impacted Systems
| Vendor / Product | ownCloud Server / owncloud/core |
| Vulnerability | CVE-2023-49105 — WebDAV API authentication bypass |
| Affected versions | 10.6.0 through 10.13.0 |
| Fixed version | 10.13.1 or later; current supported ownCloud Server releases are preferred |
| Platform / deployment | Self-managed ownCloud Server 10 |
| Not affected | ownCloud Infinite Scale and ownCloud managed services are not affected by this Server 10 issue |
| Required conditions | Attacker knows a valid username; target account has no signing key configured; WebDAV endpoint is reachable |
| Primary security impact | Unauthorized access to user files through crafted pre-signed WebDAV requests |
| Known exploitation | Confirmed; added to CISA KEV and tied to targeted data theft |
| Reported infrastructure | 31.58.209.241 |
| Observed outcome | 176 files / approximately 372 MB reportedly exfiltrated in the documented intrusion |
Why this matters
ownCloud frequently stores sensitive internal documents, exports, credentials, keys, archives, and collaboration data. The bypass does not require password or MFA compromise, so normal identity controls may not prevent file access when the vulnerable WebDAV condition exists.
Exploitation Status
Confirmed exploitation. CISA added CVE-2023-49105 to KEV. Public reporting ties the vulnerability to targeted data theft. Chinese-language artifacts support a Chinese-speaking operator assessment, but state sponsorship was not confirmed.
What this hunt looks for
Confirmed-source activity, repeated WebDAV operations, rare/new WebDAV clients, sensitive-file requests, deletion/modification methods, high-rate enumeration behavior, and web-server fallback telemetry.
Required logs
CommonSecurityLogor equivalent WAF/reverse-proxy/web access telemetrySyslog/ Apache / Nginx access logs when ingested into Sentinel
Hunt 1 — First-Pass: Reported Source Accessing ownCloud WebDAV
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP == "31.58.209.241"
| where RequestURL has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| project TimeGenerated, SourceIP, DestinationHostName, DestinationIP, RequestMethod, RequestURL, RequestClientApplication, DeviceAction, Message
| sort by TimeGenerated ascHunt 2 — High-Volume WebDAV File Access
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| where RequestMethod in~ ("GET","PROPFIND","REPORT","PUT","DELETE","MOVE","COPY")
| summarize Requests=count(), Methods=make_set(RequestMethod,20), UniqueURLs=dcount(RequestURL), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationHostName, bin(TimeGenerated,15m)
| where Requests >= 25 or UniqueURLs >= 15
| sort by Requests descHunt 3 — First-Seen WebDAV Sources Compared With Baseline
let BaselineSources = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| where RequestURL has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| summarize by SourceIP, DestinationHostName;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| join kind=leftanti BaselineSources on SourceIP, DestinationHostName
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Methods=make_set(RequestMethod,20), URLs=make_set(RequestURL,50), UserAgents=make_set(RequestClientApplication,20) by SourceIP, DestinationHostName
| sort by FirstSeen descHunt 4 — Sensitive File Types Requested Through WebDAV
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| where RequestMethod =~ "GET"
| where RequestURL has_any (".pem",".key",".pfx",".p12",".env",".sql",".bak",".backup",".zip",".7z",".tar",".gz",".kdbx",".config",".conf",".csv",".xlsx")
| project TimeGenerated, SourceIP, DestinationHostName, RequestMethod, RequestURL, RequestClientApplication, DeviceAction
| sort by TimeGenerated ascHunt 5 — Destructive or Write-Oriented WebDAV Methods
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| where RequestMethod in~ ("PUT","DELETE","MOVE","COPY","MKCOL","PROPPATCH")
| summarize Requests=count(), Methods=make_set(RequestMethod,20), URLs=make_set(RequestURL,50), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationHostName
| sort by Requests descHunt 6 — Rare WebDAV User Agents
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Sources=dcount(SourceIP) by RequestClientApplication
| sort by Requests ascHunt 7 — Reported Infrastructure Across Network Security Logs
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP == "31.58.209.241" or DestinationIP == "31.58.209.241"
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, SourcePort, DestinationIP, DestinationPort, Protocol, DeviceAction, RequestURL, Message
| sort by TimeGenerated ascHunt 8 — ownCloud WebDAV Activity in Web Server Syslog
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("/remote.php/dav","/remote.php/webdav","/dav/files")
| where SyslogMessage has_any ("GET ","PROPFIND ","REPORT ","PUT ","DELETE ","MOVE ","COPY ")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated ascDetection Notes
- The best signals are unusual WebDAV access patterns and sources, not endpoint process activity, because the vulnerability primarily bypasses file-access authentication.
- The reported IP is useful for retrospective hunting but should not be treated as the only attacker infrastructure.
- Sensitive-file extension hunting is heuristic and can produce legitimate administrative or backup activity.
- WebDAV logs must preserve the request URL and method. If those fields are not ingested into Sentinel, this hunt has materially reduced coverage.
- Telemetry compatibility does not prove ownCloud is deployed; confirm asset presence separately.
Killian Sherer 