1.0 Introduction
Recently, a path traversal vulnerability in ONLYOFFICE Docs (CVE-2021-3199) is being exploited in the wild.
2.0 Impact
Successful exploitation of this vulnerability may allow a remote attacker to bypass security restrictions and trigger remote code execution on the targeted system, through a specially crafted request to the upload function when JWT is used. The vulnerability has a CVSS v3.1 base score of 9.8. This may lead to execution of arbitrary code, unauthorised access to sensitive documents and system compromise.
3.0 Affected Products
- ONLYOFFICE Docs (Document Server), versions earlier than 5.6.3.
4.0 Recommendation
CyberSecurity
Malaysia encourages users and administrators to review the following advisories
and apply the necessary updates. Organisations are advised to upgrade to the
latest supported ONLYOFFICE Docs release, and to restrict access to Document
Server from untrusted networks until the update is applied.
Kindly refer to the following URL:
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563