VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

The ONLYOFFICE ownCloud integration plugin (version 9.12) contains an SSRF vulnerability in the /apps/onlyoffice/ajax/settings/address endpoint. This endpoint insufficiently validates the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can exploit this flaw to coerce the ownCloud server into making arbitrary network requests, including to localhost and internal network hosts. By observing differences in response errors, the attacker can perform internal network reconnaissance and TCP port scanning, increasing the attack surface for potential follow-on exploits. The vulnerability arises because the plugin does not restrict or sanitize the document server URL parameter, allowing server-side request execution.

Successful exploitation enables an authenticated administrator to trigger arbitrary outbound network requests from the ownCloud server, access localhost services not reachable externally, perform internal network reconnaissance, and conduct TCP port scanning. This expands the attack surface by potentially exposing internal services to further exploitation. The vulnerability leverages the ownCloud server as a proxy for these requests.

No official patch or vendor fix is currently available as the vendor could not be reached for coordination. It is recommended to disable or remove the ONLYOFFICE ownCloud integration plugin until a patched version is released. Additionally, network-level egress controls should be implemented to restrict outbound connections from the ownCloud server to authorized destinations only. Monitoring or other mitigations should focus on limiting the server's ability to make arbitrary outbound requests.