Disclosure of sensitive credentials and configuration in containerized deployments - ownCloud (owncloud.com)

submitted 7 months ago by Anonymouse@lemmy.world to c/selfhosted@lemmy.world

29 comments fedilink hide all child comments

I haven't seen this posted yet here, but anybody self-hosting OwnCloud in a containerized environment may be exposing sensitive environment variables to the public internet. There may be other implications as well.

you are viewing a single comment's thread
view the rest of the comments

[-] deepdive@lemmy.world 7 points 7 months ago

That's way exposing your home services to the internet is a bad idea. Accessing it through a secure tunnel is the way to go.

Also, they already "fixed" the docker image with an update, something todo with phpinfo...

[-] i_am_not_a_robot@discuss.tchncs.de -1 points 7 months ago

Nobody cares about your home services unless they can use them to send spam or mine bitcoin. Owncloud is a funny name because it seems to imply it's for personal use: your own cloud. I didn't know until I found myself in one, but apparently a lot of schools use Owncloud.

phpinfo is just a bad idea. It's a built in facility that dumps everything without knowing whether it's sensitive or not, right into the current page, making it trivial to add this vulnerability to your own application or library that an unsuspecting developer will include into their application. There's not even a single security warning in the documentation. Here's practically the same problem from 21 years ago: https://nvd.nist.gov/vuln/detail/CVE-2002-1725

this post was submitted on 01 Dec 2023

81 points (98.8% liked)

Selfhosted

37715 readers

463 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz