CVE-2012-5609

Vulnerability

A code execution vulnerability exists in the user migration import functionality of ownCloud versions prior to 4.5.2. The incomplete blacklist in lib/migrate.php fails to block the upload and extraction of a specially crafted mount.php file from a ZIP archive. When a user imports migration data (ZIP file), the mount.php file is placed within the user's data directory and can be executed by the web server, leading to arbitrary PHP code execution. The issue is addressed in ownCloud 4.5.2 [1][4].

Exploitation

An authenticated remote attacker with the ability to access the migration import feature (users with permission to import account data) can exploit this vulnerability. The attacker uploads a crafted ZIP archive containing a malicious mount.php file along with an export_info.json file. The import process extracts the ZIP content and copies files to the user's data directory. The attacker then accesses the uploaded mount.php via the web server, which executes the PHP code within it [2][3].

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the ownCloud server. This can lead to complete compromise of the ownCloud instance, including unauthorized access to all stored data, modification or deletion of files, and potential lateral movement within the hosting environment. The attacker gains the privileges of the web server user, which typically has significant access to the server's file system and database [1].

Mitigation

Users should upgrade to ownCloud version 4.5.2 or later, which contains the fix. The patch, visible in commit e8a0cea and 4619c66, improves file handling during migration by properly scanning and copying only allowed directories and removing the insecure custom recursive copy routine [2][3]. No reliable workaround exists for unpatched versions; administrators should disable or restrict access to the migration import functionality if upgrading is not immediately possible. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.