ONLYOFFICE DocumentServer vulnerabilities

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

An out-of-bounds memory access vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2. A remote attacker can execute arbitrary code using a crafted JavaScript file.

A use-after-free vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 allows remote attackers to execute arbitrary code via a crafted JavaScript file.