Critical · published January 26, 2021
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.5th percentile for exploit probability.
⚠️ A sneaky directory traversal flaw lurking in ONLYOFFICE Document Server lets attackers get crafty with image uploads! Think of this vulnerability like a delivery driver misreading an address and dropping off packages in the wrong location — in this case, an attacker can send a cleverly crafted upload that leads to unauthorized file access. If exploited, an attacker could gain remote code execution on the server, potentially accessing sensitive files or altering document processes. It’s like opening a door that should’ve been locked, allowing malicious activities to unfold uninterrupted!
Think of this vulnerability like a delivery driver misreading an address and dropping off packages in the wrong location — in this case, an attacker can send a cleverly crafted upload that leads to unauthorized file access. This directory traversal vulnerability occurs when the server accepts a '/..' sequence in the image upload parameter, enabling an attacker to navigate outside the intended directory and execute code remotely.
If exploited, an attacker could gain remote code execution on the server, potentially accessing sensitive files or altering document processes. It’s like opening a door that should’ve been locked, allowing malicious activities to unfold uninterrupted! To protect your system, upgrade ONLYOFFICE Document Server to version 5.6.3 or later immediately. If you are using JWT, ensure proper validation of upload parameters and restrict file paths to prevent unauthorized access. You've got this! By taking these steps, you'll be a security hero, safeguarding your server from potential threats! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| onlyoffice/document_server | < 5.6.3 | 5.6.3 |