PT-2020-12672 · Onlyoffice · Onlyoffice Document Server

Andrew Krasichkov · Published 2020-04-15 · Updated 2020-04-22 · CVE-2020-11535

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server version 5.5.0

Description An issue was discovered that allows an attacker to craft a malicious .docx file and exploit XML injection. This can lead to entering an attacker-controlled parameter into the x2t binary, potentially allowing the attacker to rewrite the binary and/or libxcb.so.1, and execute code on a victim's server.

Recommendations For ONLYOFFICE Document Server version 5.5.0, consider restricting the processing of .docx files from untrusted sources until a fix is available. As a temporary workaround, restrict access to the x2t binary to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2020-11535

Affected Products

Onlyoffice Document Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-11535 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11535 · Vendor Advisory
• https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551 · Note
• https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0 · Note