CVE-2025-68935

Executive Summary

CVE-2025-68935 is a stored Cross-Site Scripting (XSS) vulnerability in ONLYOFFICE Docs, specifically within the Multilevel list settings window. An attacker can inject arbitrary JavaScript code via the Font field, which is then executed in the context of the victim's browser when the malicious document is viewed. The vulnerability affects versions prior to 9.2.1. While the CVSS score is 6.4 (Medium), the lack of a public exploit and low EPSS score (0.0%) suggest limited active exploitation, but the risk remains for targeted attacks against document collaboration platforms.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must open the crafted document.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exfiltration possible.
• Integrity Impact: Low (I:L) – limited ability to modify content.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction and has limited impact, but it can be used in phishing campaigns or to compromise document integrity in collaborative environments.

Deep Dive & Mechanics

The vulnerability resides in the Multilevel list settings window of ONLYOFFICE Docs. When a user creates or edits a multilevel list, the Font field is not properly sanitized before being rendered in the document editor. An attacker can craft a document containing a malicious payload in the Font field, such as:

<script>alert('XSS')</script>

When a victim opens this document and interacts with the multilevel list settings (e.g., by clicking on the list to edit it), the payload is executed in the browser context. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or deface the document.

The root cause is insufficient output encoding of user-supplied data in the Font field before it is inserted into the HTML DOM. The fix in version 9.2.1 likely involves proper escaping or sanitization of this field.

Vulnerable vs. Patched Code

Vulnerable Code (before 9.2.1):

// In the multilevel list settings handler
function applyFont(fontName) {
    var fontField = document.getElementById('font-field');
    fontField.innerHTML = fontName; // Direct innerHTML assignment - vulnerable
}

Patched Code (9.2.1+):

// In the multilevel list settings handler
function applyFont(fontName) {
    var fontField = document.getElementById('font-field');
    fontField.textContent = fontName; // Safe textContent assignment - no HTML injection
}

The patched version uses textContent instead of innerHTML, which automatically escapes any HTML tags, preventing XSS.

Exploitation & Lab Setup

Red Team

1. Craft the malicious document:

   • Create a new document in ONLYOFFICE Docs.
   • Insert a multilevel list.
   • In the Font field of the list settings, enter the payload:

     <img src=x onerror=alert(document.cookie)>
     

   • Save the document.

2. Deliver the document:

   • Send the document via email, upload to a shared workspace, or host it on a compromised site.

3. Trigger the exploit:

   • The victim opens the document and clicks on the multilevel list to edit it.
   • The payload executes, exfiltrating cookies or performing other actions.

Blue Team

1. Detection:

   • Monitor for documents containing suspicious HTML/JavaScript in the Font field metadata.
   • Use network monitoring to detect outbound connections from the ONLYOFFICE editor process.

2. Prevention:

   • Apply the patch by upgrading to version 9.2.1.
   • Implement Content Security Policy (CSP) headers to restrict script execution.
   • Use web application firewalls (WAF) to filter malicious payloads in document uploads.

3. Response:

   • If exploitation is suspected, isolate the affected system and review document access logs.
   • Rotate any potentially compromised session tokens.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Documents containing <script> tags or event handlers (e.g., onerror, onload) in the Font field of multilevel list settings.
  • Unusual outbound HTTP requests from the ONLYOFFICE editor process.

• Network-based IOCs:

  • Connections to known malicious domains or IP addresses from the ONLYOFFICE server.
  • Anomalous data in HTTP headers or POST bodies that resemble JavaScript payloads.

• Behavioral IOCs:

  • Unexpected pop-ups or alerts when editing multilevel lists.
  • Unauthorized changes to document content or user settings.

Detection Engineering

YARA Rule

rule CVE_2025_68935_ONLYOFFICE_XSS {
    meta:
        description = "Detects documents exploiting CVE-2025-68935 via Font field XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68935"
    strings:
        $xss_payload_1 = /<script[^>]*>.*?<\/script>/is
        $xss_payload_2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss_payload_3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $font_field = /Font[^<]*<[^>]*>/is
    condition:
        all of ($xss_payload_*) and $font_field
}

Sigma Rule

title: CVE-2025-68935 - ONLYOFFICE Docs XSS via Font Field
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-68935 by monitoring document uploads containing XSS payloads in the Font field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: '*/upload*'
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in document metadata (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68935 - ONLYOFFICE Docs XSS via Font Field"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; pcre:"/on(error|load)\s*=\s*["']?[^"'\s>]+/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Upgrade ONLYOFFICE Docs to version 9.2.1 or later.
   • If upgrade is not possible, apply a virtual patch using a WAF to block payloads containing <script> or event handlers in document uploads.

2. Long-term Measures:

   • Implement strict input validation and output encoding for all user-supplied fields in the document editor.
   • Conduct regular security audits of the ONLYOFFICE codebase.
   • Enable Content Security Policy (CSP) headers to mitigate XSS impact.

3. Monitoring:

   • Continuously monitor for exploitation attempts using the provided detection rules.
   • Review access logs for unusual document editing behavior.

Valters IT
Securing Digital Frontiers