VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability
ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.
CERT/CC published VU#943094 for a server-side request forgery in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12, tracked as CVE-2026-84282. The /apps/onlyoffice/ajax/settings/address endpoint does not validate the user-supplied document server URL, so an authenticated administrator can make the ownCloud server send arbitrary requests to localhost and internal hosts. Differences in error responses (connection failures vs SSL/TLS errors) let attackers enumerate open and closed TCP ports for internal reconnaissance. The vendor could not be reached, so no official patch is available; CERT recommends disabling the plugin and applying egress filtering until a fix ships.
- SSRF in ONLYOFFICE ownCloud integration plugin 9.12
- Authenticated admins can reach localhost and internal hosts
- Error-based side channels reveal open/closed TCP ports
- No vendor patch; disable plugin and apply egress controls
- Reported by ETC JSC researchers via CERT/CC
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-84282 | SSRF in ONLYOFFICE ownCloud Integration plugin 9.12 CVE-2026-84282 is a server-side request forgery (SSRF) in the ONLYOFFICE ownCloud Integration plugin version 9.12, where the /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before the ownCloud server makes outbound connections. To trigger it, an authenticated administrator supplies a manipulated 'document server' parameter, causing the server to send requests to attacker-chosen destinations, including localhost and internal network hosts. An attacker gains internal network reconnaissance and can perform TCP port scanning of the ownCloud host's local network by differentiating server responses. Only ownCloud deployments running this integration plugin are affected, and exploitation requires administrative access, so an attacker would typically need a compromised or untrusted admin account. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at 0.2% (6th percentile). Do: No fixed version is specified in the available data, so check the ONLYOFFICE advisory and CERT/CC VU#943094 for a patched release and update the integration plugin as soon as one is published. In the interim, restrict admin access to the ONLYOFFICE settings page, restrict the Document Server URL to the approved ONLYOFFICE host, and apply egress filtering on the ownCloud server so it cannot probe localhost or arbitrary internal hosts; note CVSS has not yet been scored for this CVE. | 6.5 | <1% |
| moderate≈ low thousands of ownCloud deployments (estimate; no public install counts for this optional integration plugin) |
Full article449 words · extracted from kb.cert.org · click to collapse
Overview
A Server-Side Request Forgery (SSRF) vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin (version 9.12). The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated administrator can exploit this flaw to coerce the ownCloud server into issuing arbitrary network requests to attacker‑controlled destinations.
Description
The ownCloud ecosystem delivers a platform for enterprise file collaboration, providing capabilities for storing, syncing, and sharing data across devices. Ascensio System SIA's ONLYOFFICE provides a connector that integrates with ownCloud, enabling users to open and edit files directly within the cloud storage environment.
When configuring the ONLYOFFICE document server within ownCloud, the plugin accepts a document server parameter and attempts to verify the supplied URL by initiating a connection directly from the ownCloud server. As detailed in CVE-2026-84282, the application does not restrict or sanitize this parameter, allowing an authenticated administrator to provide arbitrary URLs, including internal network hosts or localhost addresses. By submitting crafted configuration requests to the /apps/onlyoffice/ajax/settings/address endpoint, an attacker can instruct the server to make outbound requests to internal systems that are otherwise inaccessible externally. Differences in returned error messages (such as connection failures versus SSL/TLS negotiation errors) enable the attacker to distinguish between open and closed TCP ports, facilitating internal network reconnaissance and port enumeration. The outbound requests originate from the ownCloud server, demonstrating server‑side request execution consistent with an SSRF vulnerability. This vulnerability could allow an attacker to abuse the ownCloud server infrastructure as a proxy to send malicious content to targeted systems.
Impact
Successful exploitation allows an authenticated administrator to:
* Trigger arbitrary outbound network requests from the ownCloud server (SSRF).
* Access and probe localhost services (127.0.0.1) not reachable externally.
* Perform internal network reconnaissance and port scanning.
* Identify open and closed TCP ports through response‑based side channels.
* Increase the attack surface for potential follow‑on exploitation of internal services.
Solution
Unfortunately, the vendor could not be reached to coordinate this vulnerability. While an official patch is not available at this time, there are a few general recommendations that may help mitigate this vulnerability. Disable or remove the plugin until a patched version is released. Network‑level egress controls should be applied to limit outbound connections from the ownCloud server to authorized destinations only.
Acknowledgements
Thank you to Nguyen Huy Hoang, Nguyen Vu Long and Nguyen Tien Dat of ETC JSC for reporting this vulnerability. This document was written by Bob Kemerer.
Vendor Information
943094
Filter by status:
Filter by content: Additional information available
Sort by:
Other Information
| CVE IDs: | CVE-2026-84282 |
| API URL: | VINCE JSON | CSAF |
| Date Public: | 2026-09-08 |
| Date First Published: | 2026-09-08 |
| Date Last Updated: | 2026-09-08 14:23 UTC |
| Document Revision: | 1 |
Text extracted automatically; images, tables and formatting may be missing. Original: https://kb.cert.org/vuls/id/943094