CVE-2012-4389

Vulnerability

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before version 4.0.7 allows remote attackers to upload a crafted .htaccess file via an import.zip archive. The affected code path is in the copy_r function, which did not exclude .htaccess files from being copied during the import process [2]. This enables the attacker to bypass access controls and execute arbitrary PHP code.

Exploitation

An attacker needs network access to the ownCloud instance and the ability to upload an import archive (e.g., import.zip). The attacker crafts a ZIP file containing a malicious .htaccess file (e.g., to enable arbitrary PHP execution) and a PHP file. Upon importing the ZIP, the copy_r function copies the .htaccess file into the destination directory, therefore overriding any existing restrictions. The attacker can then directly access the uploaded PHP file to achieve code execution [1].

Impact

Successful exploitation allows remote attackers to execute arbitrary code on the ownCloud server with the privileges of the web server. This can lead to full compromise of the ownCloud installation, including data theft, modification, or further server-side attacks.

Mitigation

Fixed in ownCloud version 4.0.7, released in September 2012. Users should update to 4.0.7 or later. The fix adds .htaccess to the list of skipped files in the copy_r function [2]. No workaround is available for earlier versions.