CVE-2021-25830 Code injection in n/a

Critical 9.8 Published 1 Mar 2021 Updated 3 Aug 2024

An attacker can achieve remote code execution on ONLYOFFICE DocumentServer by requesting conversion of a crafted file using improper string handling bugs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-25830?

CVE-2021-25830 is a critical code injection vulnerability in n/a, published on 1 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.

Which versions are affected by CVE-2021-25830?

It affects 1 product.

Products include Onlyoffice Document Server.

How do I fix CVE-2021-25830?

No fix has been published for CVE-2021-25830 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-25830 being exploited?

There is no known exploitation of CVE-2021-25830 in the wild and no public exploit code.

Sources

Also known as GHSA-5mvf-vvh4-mj9c.