External risk intelligence

ONLYOFFICE DocumentServer Out-of-Bounds Memory Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-30187

ONLYOFFICE DocumentServer is typically deployed as a web-based document editing and collaboration platform. Such services are commonly exposed as internet-facing web applications or integrated into edge-accessible environments to facilitate remote document collaboration, making the interface reachable from the public internet in many standard deployment scenarios.

Out-of-bounds Write

Onlyoffice Document Server

4.0.3 to 7.3.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in ONLYOFFICE DocumentServer could allow an unauthenticated remote attacker to execute arbitrary code by uploading a specially crafted JavaScript file. The issue stems from an out-of-bounds memory access within the software, potentially impacting the confidentiality, integrity, and availability of systems processing documents.

Attackers can run their code on servers.
Critical issue allows remote code execution.
Confirm if this software is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted JavaScript file to a vulnerable instance of ONLYOFFICE DocumentServer. This could lead to arbitrary code execution on the server, potentially allowing the attacker to compromise the system.

No specific access required.
Triggered by uploading a malicious file.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An out-of-bounds memory access vulnerability in ONLYOFFICE DocumentServer could allow remote attackers to execute arbitrary code by uploading a specially crafted JavaScript file. This could affect the integrity and availability of the document server.

Server code execution and system compromise.
Via crafted JavaScript file upload.
Service disruption and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects ONLYOFFICE DocumentServer instances. Application owners and infrastructure teams should lead the response by first identifying all deployments, confirming their exposure and criticality, and then planning remediation. Coordination with the vendor is essential for understanding and implementing fixes or mitigations.

Application owners should assume issue ownership.
Verify external accessibility and business criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ONLYOFFICE DocumentServer?

ONLYOFFICE DocumentServer is a suite used for web-based document editing and collaboration. It functions as a server-side component that processes various file formats, allowing teams to work on documents simultaneously over a network. It is widely used to provide browser-based office functionality.

What does out-of-bounds memory access mean for CVE-2023-30187?

This is a memory safety issue classified as CWE-787. It occurs when software writes data past the intended boundary of a memory buffer. In the context of this CVE, this defect allows an attacker to manipulate memory to run unauthorized commands or arbitrary code on the server, rather than simply causing the application to crash.

How is this vulnerability triggered?

The vulnerability is triggered when the server processes a specially crafted JavaScript file. This requires an attacker to interact with the file upload or processing capabilities of the document server. Merely viewing or browsing the document server interface without uploading or processing such a malicious file does not trigger the execution path.

Is my ONLYOFFICE instance at risk?

According to Halo Surface Signal, this software is often deployed as a web-based collaboration platform, making it frequently internet-facing. If your instance is reachable from the public internet to facilitate remote collaboration, the likelihood of an attacker reaching the vulnerable service is higher than for systems restricted to an internal-only network.

How should I respond to this threat?

Begin by auditing your infrastructure to create an inventory of all active DocumentServer instances. Prioritize identifying which instances are internet-facing. Once located, coordinate with the vendor to obtain and apply the necessary updates that address this memory access vulnerability to secure your document processing pipeline.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.