#LOGICALDOC ACCESS MENU 1160 UPDATE#
#LOGICALDOC ACCESS MENU 1160 SOFTWARE#

Fri, Dec 2, 2022: Support ticket #37150 suggests emailing Mon, Dec 5, 2022: Provided details to the vendor.

Thu, Dec 1, 2022: Initial notification to the vendor via guessed email addresses and support channels.

October-November: Research project on DMS vulnerabilities initiated by Matthew Kienow.

Given the high severity of a stored XSS vulnerability in a document management system, especially one that is often part of automated workflows, administrators are urged to apply any vendor-supplied updates on an emergency basis.

XSS filter evasion is a constantly evolving field, but a reasonable scanner should be able to at least pick out common XSS patterns. Of course, many modern workflows depend on cataloging inbound documents, so this advice should be backed up with a robust document scanner that automatically searches for common XSS patterns embedded in documents.

In the absence of an update from the vendor, users of the affected DMS should take care when importing documents from unknown or untrusted sources. Once enabled, the attacker would have access to the stored documents, which may be critically important to the targeted organization. A typical attack pattern would be to steal the session cookie that a locally-logged in administrator is authenticated with, and reuse that session cookie to impersonate that user to create a new privileged account.Ī slightly more subtle and extensible attack would be to hook the victim's browser session and inject the attacker's own commands under the identity of the hooked user, using BeEF or similar post-exploitation tooling. Once an attacker has provided a malicious document, and a suitable victim has triggered the XSS condition, the attacker has several avenues for furthering their control over the target organization.

Type one of the words on either side of the tag (one, two, three, or four) and it will cause the related XSS to execute in the user’s web browser.Open the search panel by clicking the magnifying glass icon on the left side of the editor.For example, /Products/Files/DocEditor.aspx?fileid=11 is a typical path. Select the document and open it with either the edit or preview option.Upload or create a new document that contains the following two lines of text and tags:.Reproduction of the issue is straightforward: One technique to ensure success would be to create a document with several commonly searched-for terms, which will depend on the target organization's industry, commonly spoken language, and other factors. Once indexed, the attacker then needs to wait for, or convince, a user to trigger the stored document via the search functionality provided by ONLYOFFICE Workspace. The details of how this might happen are going to vary significantly between sites, ranging from an email or web-based portal for submitting documents automatically to the target organization, to convincing a human operator to manually save the malicious document on behalf of the attacker, to an insider indexing their own document and waiting for another user to trigger the XSS condition. The attack hinges on the ability of the attacker to get a document saved in the DMS for indexing. The test instance was installed using the Docker image and the instructions for installing ONLYOFFICE Workspace using the provided script.

It is likely the vulnerability exists in previous versions of the software as well as the Enterprise offering. This vulnerability was identified in testing against ONLYOFFICE Workspace Version 12. Read more about ONLYOFFICE at the vendor's website.

ONLYOFFICE Workspace is an AGPL licensed DMS, available as an on-prem or cloud-hosted collaboration platform. Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or 'Type II') cross-site scripting (XSS) condition. CVE-2022-47412: ONLYOFFICE Workspace Search Stored XSS When we become aware of patches or vendor advisories, we will update this advisory with that information. As such, these issues are being disclosed in accordance with Rapid7's vulnerability disclosure policy. Unfortunately, none of these vendors were able to respond to Rapid7's disclosure outreach, despite having coordinated these disclosures with CERT/CC. VendorĪll of these issues were discovered by Rapid7 researcher Matthew Kienow, and validated by Rapid7's security sciences team. The issues are summarized in the table below. While all of the discovered issues are instances of CWE-79: Improper Neutralization of Input During Web Page Generation, in this disclosure, we have ordered them from most severe to least. Through the course of routine security testing and analysis, Rapid7 has discovered several issues in on-premises installations of open source and freemium Document Management System (DMS) offerings from four vendors.

#LOGICALDOC ACCESS MENU 1160 UPDATE#

#LOGICALDOC ACCESS MENU 1160 SOFTWARE#

Logicaldoc access menu 1160