SSRF flaw in ONLYOFFICE ownCloud plugin
An unpatched SSRF vulnerability in the ONLYOFFICE ownCloud integration plugin lets admins force the server to probe internal hosts and localhost services.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC has published an advisory for CVE-2026-84282, a Server-Side Request Forgery vulnerability in Ascensio System SIA's ONLYOFFICE integration plugin for ownCloud (version 9.12). The plugin's document server configuration endpoint, /apps/onlyoffice/ajax/settings/address, fails to validate or restrict the supplied document server URL before the ownCloud backend initiates an outbound connection to it. An authenticated administrator can submit crafted configuration requests pointing to internal hosts or localhost (127.0.0.1), causing the ownCloud server to issue requests on the attacker's behalf.
Because the plugin returns different error messages depending on connection outcome (e.g., TCP connection failure versus SSL/TLS negotiation failure), an attacker can use these response differences as a side channel to enumerate open versus closed ports on internal systems, enabling network reconnaissance that would otherwise be blocked from external access. This effectively turns the ownCloud server into a proxy for internal scanning and could facilitate follow-on attacks against internal services discovered this way.
The vendor could not be reached to coordinate disclosure, so no patch is currently available. CERT/CC recommends disabling or removing the ONLYOFFICE plugin until a fix is released, and applying network-level egress controls to restrict outbound connections from the ownCloud server to authorized destinations only. Exploitation requires authenticated administrator access, which somewhat limits the attack surface, but organizations running affected ownCloud/ONLYOFFICE integrations should treat this as a priority to mitigate given the lack of vendor patch.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/943094
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs