# Chinese Threat Actor Exploits Critical ownCloud Flaw to Raid Philippine Nuclear Research Files

## The Threat

A critical vulnerability in ownCloud's WebDAV interface is being weaponized in the wild — and the target is as geopolitically charged as they come. CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog this week after evidence emerged that a Chinese-speaking threat actor used the flaw to breach a nuclear research organization in the Philippines, exfiltrating what are described as nuclear records.

CVE-2023-49105 is an authentication bypass in ownCloud's WebDAV API. An unauthenticated attacker can reach the API directly and interact with files on the server — reading, modifying, or deleting them — without supplying valid credentials. No phishing, no credential stuffing, no foothold required. Just network access and the exploit. At a CVSS 9.8, it sits just below the theoretical maximum, and the actual attack complexity justifies that score.

The vulnerability was disclosed in November 2023 alongside two related ownCloud flaws. While CVE-2023-49103 (which exposes admin credentials via a phpinfo endpoint) grabbed most of the initial attention, CVE-2023-49105 is the one that translates most directly into unauthorized file access at scale. Research institutions, government agencies, and universities — the exact organizations that tend to run self-hosted ownCloud deployments and lag on patch cadence — are the natural victims.

## Severity and Impact

| Field | Detail |
|---|---|
| **CVE** | CVE-2023-49105 |
| **CVSS Score** | 9.8 (Critical) |
| **CVSS Vector** | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| **Attack Complexity** | Low |
| **Authentication Required** | None |
| **CWE** | CWE-287 (Improper Authentication) |
| **CISA KEV Added** | August 2026 |
| **Known Exploitation** | Active — confirmed nation-state actor |

## Affected Products

**ownCloud Core (WebDAV API)**
- All versions prior to the November 2023 security patch
- Instances where WebDAV is enabled (default configuration)
- Self-hosted deployments without network-layer access controls

**Deployment contexts at heightened risk:**
- Government and public sector ownCloud instances
- University and research institution deployments
- Any ownCloud server directly internet-accessible without a WAF or reverse proxy filtering WebDAV endpoints

## Mitigations

**Immediate priority:**
- Apply the ownCloud security patch released November 2023 if not already done — full stop, this is overdue
- If patching cannot happen immediately, disable or restrict access to the WebDAV API endpoint at the network or reverse proxy layer
- Audit WebDAV access logs for unauthenticated requests or anomalous file access patterns going back to at least late 2023

**Defense in depth:**
- Restrict ownCloud to internal networks or VPN; no reason a research institution's file server should be directly internet-reachable
- Implement network segmentation so the ownCloud server cannot reach sensitive internal systems or serve as a lateral movement pivot
- Enable audit logging at the ownCloud application layer and ship logs to a SIEM for retention and alerting
- Review all user accounts for unauthorized changes and confirm no persistence mechanisms (new admin accounts, modified files) were left behind

**For organizations in sensitive sectors:**
- Threat hunt for indicators of this specific campaign if you run ownCloud and operate in nuclear research, defense, or critical infrastructure
- Consider whether ownCloud's self-hosted model fits your threat model, or whether a more hardened file-sharing solution with mandatory MFA is warranted

## References

- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [ownCloud Security Advisory — CVE-2023-49105](https://owncloud.com/security-advisories/)
- [NVD Entry: CVE-2023-49105](https://nvd.nist.gov/vuln/detail/CVE-2023-49105)

---

## HackWire Analysis

There's a lot to unpack in this incident beyond the technical specifics of the vulnerability.

Start with the target: a nuclear research body in the Philippines. The Philippines sits at the epicenter of an intensifying geopolitical dispute with China over the South China Sea — a conflict that has escalated sharply over the past two years, with maritime confrontations, diplomatic breakdowns, and what U.S. and Philippine officials have described as a sustained Chinese intelligence campaign against Philippine government and military institutions. A Chinese-speaking actor going after nuclear research files in Manila fits that strategic context precisely.

What makes this particularly galling is that CVE-2023-49105 is not a zero-day. It was publicly disclosed and patched in November 2023. The fact that it is being exploited now — and earning a KEV entry from CISA — means someone left an internet-accessible ownCloud instance unpatched for the better part of three years. Research institutions are notorious for this. They often run self-hosted infrastructure managed by a small IT staff, operate under procurement and change-management constraints that slow patching, and treat file-sharing servers as low-risk internal tools even when they're directly internet-exposed.

This case belongs to a longer pattern: academic and research institutions running open-source self-hosted tools (ownCloud, GitLab, Confluence, Moodle) become soft targets for nation-state actors precisely because they hold high-value data inside lower-security perimeters. Chinese APT groups — Volt Typhoon, APT10 affiliates, and others — have repeatedly exploited this asymmetry.

The actionable takeaway for security teams: pull your asset inventory right now and find every self-hosted file-sharing platform in your environment. If it's internet-accessible, it needs a WAF in front of it or it needs to be VPN-gated. Yesterday.

— HackWire Editorial

---

## Related Coverage

- Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
- Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
- Stay current via the [HackWire homepage](https://www.hackwire.news/)