Description
Ascensio System ONLYOFFICE Document Server是拉脱维亚Ascensio System公司的一套在线办公协作套件。该产品支持文本、电子表格和演示文稿的查看和编辑等。 Ascensio System ONLYOFFICE Document Server v4.0.0-9-v5.6.3 存在安全漏洞，该漏洞[core]模块中发现一个文件扩展名处理问题。远程攻击者可利用该漏洞可以获得DocumentServer上的远程代码执行。
ONLYOFFICE Document Server 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/de2e397b-b03e-42f7-a050-62a1d0423610
https://www.lrqa.com/en/cyber-labs/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/
https://avd.aliyun.com/detail?id=AVD-2021-25830
https://github.com/firsov/onlyoffice/blob/main/CVE-2023-34939-PoC.md
https://buaq.net/go-170195.html
https://cn-sec.com/archives/1478282.html
https://app.opencve.io/cve/?product=document_server&vendor=onlyoffice
https://medium.com/@mihat2/onlyoffice-document-server-path-traversal-fdd573fec291
https://www.cve.org/CVERecord?id=CVE-2021-25833