PT-2021-16806 · Onlyoffice · Onlyoffice Document Server

Published 2021-03-01 · Updated 2021-10-29 · CVE-2021-25831

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONLYOFFICE DocumentServer versions 4.0.0 through 5.6.3

Description A file extension handling issue was found in the [core] module of ONLYOFFICE DocumentServer. An attacker must request the conversion of a crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.

Recommendations For versions 4.0.0 through 5.6.3, consider disabling the file conversion feature from PPTT to PPTX format until a patch is available. Restrict access to the [core] module to minimize the risk of exploitation. Avoid using the file conversion functionality for crafted files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-25831

Affected Products

Onlyoffice Document Server

References · 11

• 🔥 https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25831 · Exploit
• https://github.com/ONLYOFFICE/core · Vendor Advisory
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241 · Vendor Advisory
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/Fills/BlipFill.cpp#L328 · Vendor Advisory
• https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25831 · Security Note
• https://github.com/ONLYOFFICE/DocumentServer · Note
• https://t.me/cvenotify/10702 · Telegram Post
• https://t.me/cibsecurity/24297 · Telegram Post
• https://t.me/cybersecuritytechnologies/4625 · Telegram Post