Philippine Nuclear Agency & Contractor Compromised via OwnCloud Flaw

How were the Philippine Nuclear Agency and a naval contractor breached?

The Philippine Nuclear Agency and a naval contractor were breached after attackers exploited an unconfigured ownCloud instance (CVE‑2023‑49105) to forge WebDAV URLs, and a separate LiteSpeed Cache flaw (CVE‑2024‑28000) to gain WordPress access, exposing sensitive research and engineering data. Hunt.io’s 2024 analysis shows the attackers used custom scripts to automate the theft, highlighting how default configurations can become a gateway for nation‑state actors.

What is the ownCloud vulnerability and why does it matter?

OwnCloud’s CVE‑2023‑49105 allows an adversary to create pre‑signed WebDAV URLs when the signing secret is empty—a condition that exists on fresh installations. The signing routine, as described by Hunt.io, passes an empty PBKDF2 salt and sets the OC‑Credential header to the impersonated account, enabling unauthenticated GET requests to retrieve files.

This flaw is critical because many organizations use ownCloud for internal file sharing, assuming the platform’s default settings are secure. When the signing secret is left unset, any remote actor who discovers the endpoint can effectively become a “ghost user,” pulling documents without valid credentials.

How did the attackers leverage the vulnerability?

Five bespoke Python scripts were found on the compromised server. Four scripts each targeted a specific user account, while the fifth performed a PROPFIND enumeration with a Depth: 1 header to map directory structures that were not pre‑enumerated. By forging URLs, the scripts downloaded files directly from /remote.php/dav/files/ paths, bypassing authentication altogether.

“The attack chain demonstrates that a single mis‑configuration can cascade into full data exfiltration,” noted the Hunt.io team.

Because the scripts operated under legitimate user contexts, the activity blended with normal traffic, making detection difficult without deep log analysis.

What is the LiteSpeed Cache exploit and how did it affect the naval contractor?

The naval contractor’s WordPress site was compromised via CVE‑2024‑28000, a vulnerability in LiteSpeed Cache that permits arbitrary code execution when crafted requests are processed. Hunt.io’s researchers reverse‑engineered a custom Go implementation of the MT19937 PRNG to predict mt_rand() outputs, confirming the exploit against 11 known seed/output pairs.

In parallel, the attackers performed an XML‑RPC brute‑force attack using the rockyou.txt password list, eventually gaining valid WordPress credentials. Both vectors operated independently, underscoring a multi‑stage approach that combines software bugs with credential stuffing.

Why were these two targets chosen?

Both organizations sit within the Philippines’ strategic defense and research ecosystem. The nuclear agency holds sensitive scientific data, while the naval contractor supplies critical maritime engineering services to the Philippine Navy. According to the Hunt.io report, the operator’s language profile and tooling suggest a Chinese‑speaking threat actor, aligning with broader geopolitical espionage trends targeting Southeast Asian defense assets.

What defensive steps can organizations take immediately?

First, audit ownCloud deployments for an empty signing secret and configure a strong, random secret. Second, apply the latest LiteSpeed Cache patches and disable XML‑RPC if not required. Third, implement strict monitoring of WebDAV and XML‑RPC endpoints, logging anomalous request patterns such as unexpected PROPFIND depth headers.

Regular vulnerability scanning—particularly for publicly exposed staging servers—can surface mis‑configurations before attackers discover them. Organizations should also enforce least‑privilege access for service accounts to limit the impact of any single compromised credential.

What does this incident teach about supply‑chain hygiene?

The dual‑vector attack illustrates that attackers will probe every software layer, from file‑sharing services to CMS plugins. A breach in a seemingly peripheral system, like a staging server, can cascade into the theft of high‑value data. Continuous asset inventory, timely patch management, and configuration hardening are essential components of a resilient supply‑chain security posture.

What this means for you

If your organization relies on ownCloud, WordPress, or any third‑party plugins, verify that default secrets are replaced and that all components are patched to the latest versions. Deploy network segmentation to isolate critical research and engineering environments from public‑facing services. Finally, integrate automated scanning tools—such as GetKhojo’s attack‑surface scanner—to continuously detect exposed directories, mis‑configurations, and outdated libraries before threat actors can exploit them.

Frequently asked questions

How can I check if my ownCloud instance has an empty signing secret?

Log into the ownCloud server and examine the configuration file (config.php) for the ‘secret’ parameter; if it is blank or missing, generate a strong random value and update the file, then restart the service.

Is disabling XML‑RPC a safe way to mitigate WordPress attacks?

Disabling XML‑RPC removes a common attack surface and is safe if your site does not rely on remote publishing or mobile app integrations; you can disable it via a plugin or by adding ‘disable_xmlrpc’ to the wp-config.php file.

What tools does GetKhojo offer to detect exposed staging servers?

GetKhojo provides an automated scanner that crawls public IP ranges, identifies open directories, checks for default credentials, and flags vulnerable web applications like ownCloud and WordPress before attackers can exploit them.

Can the MT19937 PRNG prediction technique be used against other PHP functions?

Yes, any PHP code that relies on <code>mt_rand()</code> with predictable seeds can be targeted; attackers can reverse‑engineer the seed if they observe enough outputs, making it advisable to switch to cryptographically secure random functions.

What immediate actions should a breached organization take?

Isolate the affected systems, rotate all credentials, apply vendor patches, conduct a forensic review of logs to identify the attack path, and notify relevant authorities and stakeholders about the data exposure.