Remote Code Execution in ONLYOFFICE Document Server

Executive Summary

This is a remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0. An authenticated attacker with a valid JWT can execute arbitrary OS commands as the ds service account. The issue occurs via the Document Builder API, which improperly processes user-controlled converter XML. By injecting a duplicate m_sFileTo element, an attacker can override the output path and write arbitrary content outside the job directory. This allows overwriting runtime.json, modifying the Document Builder executable path, and executing commands during subsequent jobs.

Useful 0 Not Useful 0

Detection Guidance

Check ONLYOFFICE Document Server logs for unusual Document Builder API activity or unexpected file writes. Monitor for processes spawned by the ds service account outside normal operations. Review runtime.json for unauthorized modifications.

Useful 0 Not Useful 0

Impact Analysis

If you use ONLYOFFICE Document Server versions before 10.0.0, an attacker could gain control of your server, execute malicious commands, steal data, or disrupt services. The attacker needs valid JWT credentials but can then escalate privileges to the ds service account, potentially compromising the entire system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or data exfiltration, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to compromised sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ONLYOFFICE Document Server to version 10.0.0 or later immediately. Disable the Document Builder API if not required. Restrict JWT authentication to trusted sources and validate all converter XML inputs.

Useful 0 Not Useful 0