Software Engineering Institute

Overview

A Server-Side Request Forgery (SSRF) vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin (version 9.12). The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated administrator can exploit this flaw to coerce the ownCloud server into issuing arbitrary network requests to attacker‑controlled destinations.

Description

The ownCloud ecosystem delivers a platform for enterprise file collaboration, providing capabilities for storing, syncing, and sharing data across devices. Ascensio System SIA's ONLYOFFICE provides a connector that integrates with ownCloud, enabling users to open and edit files directly within the cloud storage environment.

When configuring the ONLYOFFICE document server within ownCloud, the plugin accepts a document server parameter and attempts to verify the supplied URL by initiating a connection directly from the ownCloud server. As detailed in CVE-2026-84282, the application does not restrict or sanitize this parameter, allowing an authenticated administrator to provide arbitrary URLs, including internal network hosts or localhost addresses. By submitting crafted configuration requests to the /apps/onlyoffice/ajax/settings/address endpoint, an attacker can instruct the server to make outbound requests to internal systems that are otherwise inaccessible externally. Differences in returned error messages (such as connection failures versus SSL/TLS negotiation errors) enable the attacker to distinguish between open and closed TCP ports, facilitating internal network reconnaissance and port enumeration. The outbound requests originate from the ownCloud server, demonstrating server‑side request execution consistent with an SSRF vulnerability. This vulnerability could allow an attacker to abuse the ownCloud server infrastructure as a proxy to send malicious content to targeted systems.

Impact

Successful exploitation allows an authenticated administrator to:
* Trigger arbitrary outbound network requests from the ownCloud server (SSRF).
* Access and probe localhost services (127.0.0.1) not reachable externally.
* Perform internal network reconnaissance and port scanning.
* Identify open and closed TCP ports through response‑based side channels.
* Increase the attack surface for potential follow‑on exploitation of internal services.

Solution

Unfortunately, the vendor could not be reached to coordinate this vulnerability. While an official patch is not available at this time, there are a few general recommendations that may help mitigate this vulnerability. Disable or remove the plugin until a patched version is released. Network‑level egress controls should be applied to limit outbound connections from the ownCloud server to authorized destinations only.

Acknowledgements

Thank you to Nguyen Huy Hoang, Nguyen Vu Long and Nguyen Tien Dat of ETC JSC for reporting this vulnerability. This document was written by Bob Kemerer.

Vendor Information

References

• https://github.com/ONLYOFFICE/onlyoffice-owncloud/blob/master/controller/settingsapicontroller.php