ONLYOFFICE Document Server Remote Code Execution (RCE) Advisory (CVE-2021-3199)

The primary remediation is to upgrade to version 5.6.3 or higher.

1. Update via Docker

docker-compose pull
docker-compose up -d

2. WAF Implementation

Deploy Web Application Firewall (WAF) rules to inspect and block requests containing directory traversal patterns (../) in multipart/form-data upload fields.

3. Filesystem Hardening

Ensure that the directory where uploaded files are stored is mounted with the noexec flag or configured at the web server level to prevent script execution.

CVE-2021-3199 is a critical Directory Traversal (CWE-22) vulnerability located in the /upload endpoint of ONLYOFFICE Document Server. When JWT authentication is in use, the server fails to properly sanitize image upload parameters. An attacker can exploit this by injecting ../ sequences into the filename, allowing them to write arbitrary files outside the designated upload directory. This typically leads to the placement of a web shell in a web-accessible directory, resulting in full Remote Code Execution (RCE). This vulnerability is included in the CISA KEV catalog, indicating active exploitation in the wild, and carries a high EPSS score of 0.94.