OwnedCloud.

Thank you, thank you.

Honestly, all applications are vulnerable AF, especially the open source projects without a major team behind them. I work in a security research team and we find critical bugs like this in a weekly basis. Even in major projects which you would be scared to know about. I personally wouldn’t expose anything except SSH or a VPN, or if I have to expose a web app, it’s going inside a VLAN with very restrictive firewall rules, proper logging, and a reverse proxy enforcing authentication via an OIDC based IDP.

We generally spend a couple of days to a week before finding something critical allowing RCE.

This is why I don't expose anything other than my wireguard on my network

Does this affect Nextcloud?

Might be wise to use Authelia in front of any web apps as an extra layer.

POST /api/admin/unauthorized_sudo

Oh, no, it's PhpGetInfo.php, sorry, my bad.

Does this pertain to Nextcloud as well??

As article states, you're not vulnerable if you don't have the 'graphapi' app installed, whatever that is. Checked my nextcloud instance and it's not there.

I can't stress this enough, keep your private and enterprise cloud behind a vpn. Especially if you are a part time Admin with limited resources. Sooner or later you will be hacked.

That's why I keep nextcloud behind http basic auth. Don't trust those software to expose them directly to Internet.

Ist this also affecting ownCloud OCIS as well?

Thanks, OP. Now if only I could figure out how to change the SQLite database password in ownCloud 10.10 (it's not stored in config.php, but there is a "passwordsalt" configured there).

I'm surprised that ownCloud didn't use a single PHP entrypoint. In PHP software you must restrict access to .php files, that's front controller basis. They really did bad and I'm very disappointed.

Oof size: LARGE.