Skip to main content

Blog post · September 8, 2026 · kb.cert.org

CISA identifies SSRF in ONLYOFFICE ownCloud integration plugin

Summary

A Server-Side Request Forgery (SSRF) vulnerability affects Ascensio System SIA’s ONLYOFFICE ownCloud integration plugin (version 9.12). An authenticated administrator can exploit the issue to make the ownCloud server initiate outbound network requests to attacker-controlled destinations.

The vulnerability is identified as CVE-2026-84282. The plugin’s backend endpoint does not adequately validate a user-supplied document server URL before initiating outbound connections. When configuring the ONLYOFFICE document server within ownCloud, the plugin accepts a document server parameter and attempts to verify the supplied URL by initiating a connection directly from the ownCloud server. The parameter is not restricted or sanitized, enabling an authenticated administrator to provide arbitrary URLs, including internal network hosts or localhost addresses. By submitting crafted configuration requests to the /apps/onlyoffice/ajax/settings/address endpoint, an attacker can instruct the server to make outbound requests to internal systems that are otherwise inaccessible externally. Differences in returned error messages, such as connection failures versus SSL/TLS negotiation errors, enable the attacker to distinguish between open and closed TCP ports. The outbound requests originate from the ownCloud server, demonstrating server-side request execution consistent with an SSRF vulnerability.

Successful exploitation allows an authenticated administrator to trigger arbitrary outbound network requests from the ownCloud server, access and probe localhost services (127.0.0.1) not reachable externally, perform internal network reconnaissance and port scanning, identify open and closed TCP ports through response-based side channels, and increase the attack surface for potential follow-on exploitation of internal services.

No official patch is available at this time. The document states that the vendor could not be reached to coordinate this vulnerability. It also states that disable or remove the plugin until a patched version is released, and apply network-level egress controls to limit outbound connections from the ownCloud server to authorized destinations only.

Guidance provided alongside the advisory recommends disabling or removing the plugin until a patched version is released and applying network-level egress controls to restrict outbound connections from the ownCloud server to authorized destinations only.

Our summary. The original keeps its own byline.

Read the original on kb.cert.org

Companies in this article

Topics

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "legalName": "Wiretap Labs, LLC",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-identifies-ssrf-in-onlyoffice-owncloud-integration-plugin/",
        "name": "CISA identifies SSRF in ONLYOFFICE ownCloud integration plugin",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-identifies-ssrf-in-onlyoffice-owncloud-integration-plugin/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/owncloud/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/owncloud/",
      "name": "ownCloud"
    },
    "articleSection": [
      "Cybersecurity",
      "Data Center"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Director"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Security Analyst"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Cybersecurity / Exposure, Risk & Governance / Vulnerability Management & Attack Surface Management"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-09-08T11:31:15-06:00",
    "datePublished": "2026-09-08T11:31:11-06:00",
    "description": "ONLYOFFICE ownCloud integration plugin 9.12 suffers SSRF (CVE-2026-84282), letting authenticated admins trigger outbound requests and probe localhost/internal ports.",
    "headline": "CISA identifies SSRF in ONLYOFFICE ownCloud integration plugin",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/943094"
    },
    "keywords": [
      "Server",
      "Services",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-identifies-ssrf-in-onlyoffice-owncloud-integration-plugin/",
      "@type": "WebPage",
      "sdDatePublished": "2026-09-08",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/onlyoffice/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/onlyoffice/",
        "name": "ONLYOFFICE"
      },
      {
        "@id": "https://decisioninsights.ai/registry/owncloud/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/owncloud/",
        "name": "ownCloud"
      },
      {
        "@id": "https://decisioninsights.ai/projects/onlyoffice/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/onlyoffice/",
        "name": "ONLYOFFICE"
      },
      {
        "@id": "https://decisioninsights.ai/projects/owncloud/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/owncloud/",
        "name": "ownCloud"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages