Server side request forgery (ssrf)

2023-01-2315:15:00

PRIOn knowledge base

www.prio-n.com

server-side request forgery

onlyoffice

nvd

document editor service

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

43.8%

JSON

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.

CPENameOperatorVersion
serverle7.0.0.49

CPE	Name	Operator	Version
	server	le	7.0.0.49

References

github.com/ONLYOFFICE/server

labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/

www.onlyoffice.com/