PT-2020-12671 · Onlyoffice · Onlyoffice Document Server

Andrew Krasichkov · Published 2020-04-15 · Updated 2020-04-22 · CVE-2020-11534

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server version 5.5.0

Description An issue was discovered that allows an attacker to craft a malicious .docx file and exploit the NSFileDownloader function. This exploitation enables the attacker to pass parameters to a binary, such as curl or wget, and remotely execute code on a victim's server.

Recommendations For ONLYOFFICE Document Server version 5.5.0, as a temporary workaround, consider disabling the NSFileDownloader function until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-11534

Affected Products

Onlyoffice Document Server

References · 4

• https://osv.dev/vulnerability/CVE-2020-11534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11534 · Security Note
• https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551 · Note
• https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0 · Note