CVE-2021-3199: Unauthenticated Remote Code Execution in ONLYOFFICE Docs

A critical vulnerability in ONLYOFFICE Docs (CVE-2021-3199) allows unauthenticated remote attackers to achieve code execution on vulnerable Document Server instances. The flaw stems from improper sanitization in image upload handlers when JSON Web Tokens (JWT) are enabled, giving external actors a direct path to system compromise. Because ONLYOFFICE is heavily integrated into self-hosted productivity platforms like Nextcloud, ownCloud, and SharePoint, exposed servers present an attractive operational target.

Technical Analysis and Exploitation Path

The vulnerability lies within the document server’s handling of user-supplied image parameters during document editing sessions or media uploads. When JWT authentication is in place to secure API requests, the application processes payload parameters without adequately filtering path traversal sequences like /.. or \.. (CWE-22).

An attacker can construct a malicious HTTP request containing path traversal sequences embedded within the image upload parameter. Because input validation fails prior to file creation, the application writes the uploaded payload outside the intended temporary media directory. By targeting web-accessible paths or overwriting executable application files within the Node.js/web server root, an unauthenticated attacker achieves arbitrary file write and subsequent remote code execution with the privileges of the underlying service account (onlyoffice or nginx).

The CVSS 3.1 rating of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) underscores the severity: exploitation requires no privileges, no user interaction, and can be executed remotely with low attack complexity. An EPSS probability of 8.2% places this flaw in the 94th percentile for near-term exploitation, reflecting published proof-of-concept material and ongoing automated scanning targeting document management software.

Enterprise Exposure & Risk Factors

ONLYOFFICE Document Server instances often occupy a sensitive position in enterprise networks. They hold direct read/write access to confidential corporate documents, contracts, and internal communication files, while frequently maintaining backend network connections to central storage clusters and user authentication databases.

Successful compromise allows an attacker to:

• Read, alter, or destroy sensitive business documents stored in memory or passing through the conversion service.
• Steal signing keys and JWT secrets stored in configuration files (default.json / local.json).
• Use the compromised host as an internal pivot point to attack integrated cloud storage systems or adjacent network segments.

Deployment patterns that expose ONLYOFFICE Document Server directly to the public internet—especially those integrated into open-access portals—carry the highest risk profile.

Mitigation and Remediation

Organizations relying on ONLYOFFICE Docs must prioritize updating vulnerable installations immediately.

• Apply the Software Update: Upgrade ONLYOFFICE Document Server to version 5.6.3 or higher. Versions prior to 5.6.3 remain fully vulnerable to path traversal file writes.
• Edge Filtering and WAF Rules: If an immediate patch deployment is delayed, ensure your Web Application Firewall (WAF) or reverse proxy (Nginx/HAProxy) actively blocks requests containing path traversal sequences (/.., \.., %2e%2e%2f, %2e%2e/) in request paths and multi-part upload parameters directed at document processing endpoints.
• Access Control: Restrict perimeter access to the Document Server so that only trusted application hosts (e.g., your specific Nextcloud or enterprise portal IP addresses) can communicate with the API backend.
• Compliance Deadlines: Federal entities and organizations adhering to CISA BOD 26-04 guidance must remediate exposed instances or enforce complete network isolation in line with established vulnerability mitigation windows.