I haven’t seen this posted yet here, but anybody self-hosting OwnCloud in a containerized environment may be exposing sensitive environment variables to the public internet. There may be other implications as well.

  • i_am_not_a_robot
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    4
    ·
    7 months ago

    Nobody cares about your home services unless they can use them to send spam or mine bitcoin. Owncloud is a funny name because it seems to imply it’s for personal use: your own cloud. I didn’t know until I found myself in one, but apparently a lot of schools use Owncloud.

    phpinfo is just a bad idea. It’s a built in facility that dumps everything without knowing whether it’s sensitive or not, right into the current page, making it trivial to add this vulnerability to your own application or library that an unsuspecting developer will include into their application. There’s not even a single security warning in the documentation. Here’s practically the same problem from 21 years ago: https://nvd.nist.gov/vuln/detail/CVE-2002-1725