OwnCloud WebDAV Bypass Used to Exfiltrate Philippine Nuclear Data

OwnCloud WebDAV bypass fuels a data‑theft campaign in the Philippines

A threat actor siphoned 176 files, roughly 372 MB, from a Philippine nuclear research institute by abusing an ownCloud WebDAV authentication bypass.

The stolen material spans nuclear‑material records, strategic plans for 2023‑2028, reactor core component designs, fuel inventory lists, employee personal data, a 192 MB SQL dump of a ZKTeco BioTime attendance database, and credential stores such as BitLocker keys, KeePass and AxCrypt files.

Technical rundown

CVE‑2023‑49105 is a WebDAV API flaw that skips authentication when the attacker knows a valid username and the server lacks a signing‑key. The bug scores 9.8 on the CVSS scale.

It affects ownCloud core versions 10.6.0 through 10.13.0 and was patched in 10.13.1. The actor deployed five custom Python scripts to automate the exploit, each feeding known usernames to retrieve arbitrary files.

In a parallel move, the same adversary leveraged LiteSpeed Cache plugin for WordPress (CVE‑2024‑28000, CVSS 9.8) and a brute‑force XML‑RPC script named brute_xmlrpc.py to climb privileges on a separate Philippine company's WordPress site.

Who’s in the cross‑hairs

• Two Philippine entities: a nuclear research body and a marine engineering & shipbuilding firm that supplies the Philippine Navy.
• OwnCloud deployments running vulnerable core versions.
• WordPress sites protected by the LiteSpeed Cache plugin.

Indicators of compromise

• IP address hosting the open directory with the Python tools: 31.58.209.241
• File names matching the custom scripts used for the ownCloud exploit.
• Network traffic to ownCloud WebDAV endpoints without accompanying authentication headers.

Attribution note

Hunt.io’s analysis points to a Chinese‑speaking threat actor based on simplified Chinese comments in the code; this attribution has not been independently corroborated.

Defensive steps

1. Patch ownCloud to version 10.13.1 or later immediately; CISA mandates remediation by 2026‑08‑30 for Federal agencies.
2. Verify that a signing‑key is configured for WebDAV operations; disable WebDAV if not required.
3. Update the LiteSpeed Cache plugin to a version that addresses CVE‑2024‑28000.
4. Audit WordPress XML‑RPC exposure; consider disabling or rate‑limiting it.
5. Scan for the custom Python scripts or their hashes on internal hosts.
6. Review access logs for unauthenticated WebDAV GET requests targeting sensitive paths.