PT-2021-16807 · Onlyoffice · Onlyoffice Document Server

Published 2021-03-01 · Updated 2021-10-29 · CVE-2021-25832

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONLYOFFICE DocumentServer versions 4.0.0 through 6.0.0

Description A heap buffer overflow vulnerability was found in the BMP image processing of the [core] module. This issue allows an attacker to gain remote code execution on the DocumentServer.

Recommendations For versions 4.0.0 through 6.0.0, update to a version that fixes the heap buffer overflow vulnerability in the BMP image processing module. As a temporary workaround, consider disabling the BMP image processing functionality in the [core] module until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-25832

Affected Products

Onlyoffice Document Server

References · 13

• 🔥 https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25832 · Exploit
• https://github.com/ONLYOFFICE/core · Vendor Advisory
• https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L428 · Vendor Advisory
• https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L424 · Vendor Advisory
• https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/DesktopEditor/cximage/CxImage/ximabmp.cpp#L354 · Vendor Advisory
• https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/DesktopEditor/cximage/CxImage/ximabmp.cpp#L358 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25832 · Security Note
• https://github.com/ONLYOFFICE/DocumentServer · Note
• https://t.me/cvenotify/10705 · Telegram Post
• https://t.me/cvenotify/10954 · Telegram Post
• https://t.me/cibsecurity/24299 · Telegram Post
• https://t.me/cybersecuritytechnologies/4625 · Telegram Post