CVE-2021-25830
First published: Mon Mar 01 2021(Updated: )
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ONLYOFFICE | >=4.2.0.236<=5.6.4.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ONLYOFFICE/DocumentServer
- https://github.com/ONLYOFFICE/core
- https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918
- https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241
- https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/UniFill.cpp#L343
- https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25830
Frequently Asked Questions
What is the severity of CVE-2021-25830?
CVE-2021-25830 has a high severity rating as it involves file extension handling issues that can lead to remote code execution.
How do I fix CVE-2021-25830?
To fix CVE-2021-25830, you should upgrade ONLYOFFICE DocumentServer to the latest version beyond 5.6.4.13.
What versions of ONLYOFFICE DocumentServer are affected by CVE-2021-25830?
CVE-2021-25830 affects ONLYOFFICE DocumentServer versions from 4.2.0.236 to 5.6.4.13.
What type of attack can exploit CVE-2021-25830?
CVE-2021-25830 can be exploited through crafted files requested for conversion from DOCT to DOCX format.
Is CVE-2021-25830 a remote or local exploit?
CVE-2021-25830 is considered a remote exploit, as it requires an attacker to send a specially crafted file to the server.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/onlyoffice
- canonical/onlyoffice
- version/onlyoffice/4.2.0.236
- version/onlyoffice/5.6.4.13