Oops! ONLYOFFICE Docs Hit by Vulnerability – Patch Now!
SEC Consult has discovered a security flaw in ONLYOFFICE Docs (DocumentServer). This vulnerability allows for reflected cross-site scripting, giving hackers an open invitation to your server’s party. The exploit affects version 8.3.1, so updating to version 8.3.2 is highly recommended before things get too “script”ive.
Hot Take:
Oops! Looks like ONLYOFFICE Docs decided to showcase their latest feature: unintentional JavaScript execution. Talk about a surprise pop-up! Let’s hope their next update isn’t a sequel to “Cross-Site Scripting: The Uninvited Guest.”
Key Points:
- ONLYOFFICE Docs version 8.3.1 is vulnerable to Reflected Cross-Site Scripting (XSS).
- The vulnerability allows JavaScript code execution in a victim’s browser without authentication.
- The “dchat” parameter is the star of the show, allowing the injection of malicious code.
- A patched version (8.3.2) is available, addressing the security flaw.
- The vendor handled the issue through their bounty program and released a public advisory.
Already a member? Log in here