CVE-2021-25830

Опубликовано: 01 мар. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.

Ссылки

https://github.com/ONLYOFFICE/DocumentServer
Product
https://github.com/ONLYOFFICE/core
Product
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918
Third Party Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241
Third Party Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/UniFill.cpp#L343
Third Party Advisory
https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25830
Exploit
Third Party Advisory
https://github.com/ONLYOFFICE/DocumentServer
Product
https://github.com/ONLYOFFICE/core
Product
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918
Third Party Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241
Third Party Advisory
https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/UniFill.cpp#L343
Third Party Advisory
https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25830
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*

Версия от 4.2.0.236 (включая) до 5.6.4.13 (включая)

EPSS

Процентиль: 90%

0.05324

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-5mvf-vvh4-mj9c

github

больше 3 лет назад