CVE-2012-5607

Vulnerability

The "Lost Password" reset functionality in ownCloud versions before 4.0.9 and 4.5.0 does not properly check the security token, making it vulnerable to a remote timing attack [1]. The token was generated using a predictable combination of the username and random bytes, and the comparison was not constant-time, allowing an attacker to deduce the token by measuring response times [2].

Exploitation

An attacker with network access to the ownCloud instance can exploit this by initiating a password reset request for a target user and then repeatedly attempting to guess the token while measuring server response times. The timing differences reveal the correct token byte by byte, enabling the attacker to eventually construct a valid token and reset the victim's password [2]. No authentication or user interaction is required beyond the initial reset request.

Impact

Successful exploitation allows the attacker to change the password of any user account, gaining full access to that account and its data. This compromises confidentiality and integrity, and can lead to privilege escalation within the ownCloud instance [1].

Mitigation

The vulnerability is fixed in ownCloud versions 4.0.9 and 4.5.0 [1][3]. Users should upgrade to these or later versions immediately. No workarounds are documented; the fix involves double-hashing the token to eliminate timing side channels [2].