CVE-2021-25829
📋 TL;DR
CVE-2021-25829 is an improper binary stream data handling vulnerability in ONLYOFFICE DocumentServer that allows attackers to cause denial of service by sending specially crafted documents. This affects organizations using ONLYOFFICE DocumentServer for document collaboration and editing services. The vulnerability can eventually shut down the target server through resource exhaustion.
💻 Affected Systems
- ONLYOFFICE DocumentServer
📦 What is this software?
Document Server by Onlyoffice
⚠️ Risk & Real-World Impact
Worst Case
Complete server shutdown leading to service unavailability for all users, potential data loss for unsaved documents, and extended downtime requiring manual intervention.
Likely Case
Service disruption affecting document processing capabilities, temporary unavailability of ONLYOFFICE services, and potential cascading effects on dependent applications.
If Mitigated
Limited impact with proper input validation and resource monitoring, potentially causing temporary performance degradation but no complete outage.
🎯 Exploit Status
Exploitation requires sending a malicious document to the server, which can be done through normal document upload functionality. No authentication bypass needed if document upload is enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.6.4 and later
Vendor Advisory: https://github.com/ONLYOFFICE/DocumentServer/releases
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Stop ONLYOFFICE DocumentServer service. 3. Update to v5.6.4 or later using package manager or manual installation. 4. Restart the service. 5. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement WAF or proxy rules to filter suspicious PPTX documents before they reach the DocumentServer
# Example nginx rule to block large PPTX files
location ~ \.pptx$ {
client_max_body_size 10M;
deny all;
}
Resource Limiting
linuxConfigure system resource limits to prevent complete server exhaustion
# Set memory limits for ONLYOFFICE process
systemctl set-property onlyoffice-documentserver.service MemoryLimit=2G
🧯 If You Can't Patch
- Implement strict document upload restrictions and file type filtering at network perimeter
- Deploy monitoring and alerting for abnormal resource consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check current version: dpkg -l | grep onlyoffice-documentserver or rpm -qa | grep onlyoffice-documentserverCheck Version:
dpkg -l | grep onlyoffice-documentserver || rpm -qa | grep onlyoffice-documentserver || find /opt/onlyoffice -name "*.json" -exec grep -l "version" {} \;Verify Fix Applied:
Verify version is v5.6.4 or higher and test with known safe PPTX document upload📡 Detection & Monitoring
Log Indicators:
- Abnormal memory consumption spikes
- Process crashes in ONLYOFFICE logs
- Multiple failed document processing attempts
- Out of memory errors in system logs
Network Indicators:
- Unusually large PPTX file uploads
- Multiple document uploads from single source in short time
- Abnormal traffic patterns to document processing endpoints
SIEM Query:
source="onlyoffice.logs" AND ("out of memory" OR "crash" OR "segmentation fault") OR source="system.logs" AND process="DocumentServer" AND (memory>90% OR cpu>95%)🔗 References
- https://github.com/ONLYOFFICE/DocumentServer
- https://github.com/ONLYOFFICE/core
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Comments.h#L299
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Core.h#L161
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesMaster.h#L148
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesSlide.h#L141
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Presentation.h#L277
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Theme.h#L277
- https://github.com/ONLYOFFICE/core/blob/v5.6.4.10/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1722
- https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25829
- https://github.com/ONLYOFFICE/DocumentServer
- https://github.com/ONLYOFFICE/core
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Comments.h#L299
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Core.h#L161
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesMaster.h#L148
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesSlide.h#L141
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Presentation.h#L277
- https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Theme.h#L277
- https://github.com/ONLYOFFICE/core/blob/v5.6.4.10/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1722
- https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25829
