CISA identifies SSRF in ONLYOFFICE ownCloud integration plugin
3 companies named across 5 categories, the first article referencing ownCloud.
Companies mentioned
Best suited for
- Job function
- Cybersecurity / Security Analyst
- Seniority
- Director
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Early Majority
- Technology maturity
- Established Technology
- Industry
- Information Technology / Software & Services / Cybersecurity / Vulnerability Management & Attack Surface Management
Our classification, not the publisher's statement. Best suited for, not only for.
A Server-Side Request Forgery (SSRF) vulnerability affects Ascensio System SIA’s ONLYOFFICE ownCloud integration plugin (version 9.12). An authenticated administrator can exploit the issue to make the ownCloud server initiate outbound network requests to attacker-controlled destinations.
The vulnerability is identified as CVE-2026-84282. The plugin’s backend endpoint does not adequately validate a user-supplied document server URL before initiating outbound connections. When configuring the ONLYOFFICE document server within ownCloud, the plugin accepts a document server parameter and attempts to verify the supplied URL by initiating a connection directly from the ownCloud server. The parameter is not restricted or sanitized, enabling an authenticated administrator to provide arbitrary URLs, including internal network hosts or localhost addresses. By submitting crafted configuration requests to the /apps/onlyoffice/ajax/settings/address endpoint, an attacker can instruct the server to make outbound requests to internal systems that are otherwise inaccessible externally. Differences in returned error messages, such as connection failures versus SSL/TLS negotiation errors, enable the attacker to distinguish between open and closed TCP ports. The outbound requests originate from the ownCloud server, demonstrating server-side request execution consistent with an SSRF vulnerability.
Successful exploitation allows an authenticated administrator to trigger arbitrary outbound network requests from the ownCloud server, access and probe localhost services (127.0.0.1) not reachable externally, perform internal network reconnaissance and port scanning, identify open and closed TCP ports through response-based side channels, and increase the attack surface for potential follow-on exploitation of internal services.
No official patch is available at this time. The document states that the vendor could not be reached to coordinate this vulnerability. It also states that disable or remove the plugin until a patched version is released, and apply network-level egress controls to limit outbound connections from the ownCloud server to authorized destinations only.
Guidance provided alongside the advisory recommends disabling or removing the plugin until a patched version is released and applying network-level egress controls to restrict outbound connections from the ownCloud server to authorized destinations only.
Blog post, originally published at kb.cert.org.