Documentserver
Monthly
Server-side request forgery in ONLYOFFICE DocumentServer before 10.0.0 lets unauthenticated remote attackers coerce the server into fetching arbitrary internal, loopback, and cloud-metadata URLs through the /downloadfile/:docid endpoint and proxy the responses back to the requester. The flaw is reachable in the default configuration because JWT verification is disabled out of the box and a crafted request body setting the isInJwtToken flag causes the fetch to be processed as a DIRECT request, skipping the private-address request-filtering-agent; instances that have explicitly enabled JWT verification are not exploitable through this path. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the highest-value impact is on cloud-hosted deployments where reachable metadata services can expose IAM credentials, making this a genuine but moderate-priority issue (CVSS 6.3) rather than a critical emergency.
Server-side request forgery in ONLYOFFICE DocumentServer before 10.0.0 lets unauthenticated remote attackers coerce the server into fetching arbitrary internal, loopback, and cloud-metadata URLs through the /downloadfile/:docid endpoint and proxy the responses back to the requester. The flaw is reachable in the default configuration because JWT verification is disabled out of the box and a crafted request body setting the isInJwtToken flag causes the fetch to be processed as a DIRECT request, skipping the private-address request-filtering-agent; instances that have explicitly enabled JWT verification are not exploitable through this path. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the highest-value impact is on cloud-hosted deployments where reachable metadata services can expose IAM credentials, making this a genuine but moderate-priority issue (CVSS 6.3) rather than a critical emergency.