Executive brief
ONLYOFFICE provides a plugin that integrates document editing capabilities into ownCloud, a cloud file storage and collaboration platform. A vulnerability in the plugin's document server configuration endpoint allows authenticated administrators to manipulate URLs in ways that cause the ownCloud server to send network requests to arbitrary destinations, including internal systems and localhost services. This enables attackers to probe internal networks, scan for open ports, and potentially access systems that should only be reachable internally.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the ONLYOFFICE ownCloud Integration plugin version 9.12, specifically in the /apps/onlyoffice/ajax/settings/address endpoint. The plugin fails to validate or sanitize the document server URL parameter before initiating connections from the ownCloud server. An authenticated administrator can supply arbitrary URLs (including internal/localhost addresses) to trigger outbound requests from the server. Attackers can perform network reconnaissance and TCP port scanning by analyzing response differences (connection timeouts vs. SSL/TLS errors). Authentication is required (admin role), and the attack vector is network-based. No official patch is currently available from the vendor.
Affected products
- Ascensio System SIA ONLYOFFICE ownCloud Integration 9.12
Timeline
- 2026-09-08: disclosed
- 2026-08-03: other: Vendor notified