Skyeye
Monthly
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the server to fetch attacker-chosen internal URLs and overwrite any user's stored file through the OnlyOffice save callback editUploadOfficeFileById, then retrieve the modified content via queryFileToShowById. The flaw carries a CVSS 4.0 base score of 9.1 (PR:N, UI:N), although the assessed high attack complexity (AC:H/AT:P) reflects that a valid file id/key and an active OnlyOffice document-editing/callback flow are likely prerequisites, and SSRF reach is bounded by what internal addresses the server can resolve. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis.
Unauthenticated OS command injection in Dromara Skyeye allows remote attackers to execute arbitrary commands as the Skyeye service account on Windows. The flaw resides in the TTS textToSpeech endpoint, where the 'format' parameter is concatenated into a PowerShell string without sanitization; a single quote can break out and run attacker-supplied commands. Exploitation requires the instance to be running on Windows and the endpoint to be network-reachable, but no authentication or user interaction is needed, making default deployments a high-priority target. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can execute arbitrary commands on Dromara Skyeye's bundled xxl-job executor hosts by abusing JobInfoController endpoints that are annotated @PermissionLimit(limit = false). The flaw affects Skyeye deployments through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 and requires the xxl-job-admin console to be network-reachable with at least one registered executor; exploitation allows creating and starting GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-controlled glueSource. No public exploit code has been identified at time of analysis, but the vulnerability carries a CVSS v4.0 base score of 9.3 and our independent assessment rates it as CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making it a genuine high-priority issue.
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the server to fetch attacker-chosen internal URLs and overwrite any user's stored file through the OnlyOffice save callback editUploadOfficeFileById, then retrieve the modified content via queryFileToShowById. The flaw carries a CVSS 4.0 base score of 9.1 (PR:N, UI:N), although the assessed high attack complexity (AC:H/AT:P) reflects that a valid file id/key and an active OnlyOffice document-editing/callback flow are likely prerequisites, and SSRF reach is bounded by what internal addresses the server can resolve. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis.
Unauthenticated OS command injection in Dromara Skyeye allows remote attackers to execute arbitrary commands as the Skyeye service account on Windows. The flaw resides in the TTS textToSpeech endpoint, where the 'format' parameter is concatenated into a PowerShell string without sanitization; a single quote can break out and run attacker-supplied commands. Exploitation requires the instance to be running on Windows and the endpoint to be network-reachable, but no authentication or user interaction is needed, making default deployments a high-priority target. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can execute arbitrary commands on Dromara Skyeye's bundled xxl-job executor hosts by abusing JobInfoController endpoints that are annotated @PermissionLimit(limit = false). The flaw affects Skyeye deployments through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 and requires the xxl-job-admin console to be network-reachable with at least one registered executor; exploitation allows creating and starting GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-controlled glueSource. No public exploit code has been identified at time of analysis, but the vulnerability carries a CVSS v4.0 base score of 9.3 and our independent assessment rates it as CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making it a genuine high-priority issue.