Technical impact
The vulnerability exists in ONLYOFFICE DocumentServer versions prior to 10.0.0, where the /downloadfile/:docid endpoint processes the isInJwtToken flag even when JSON Web Token verification is disabled. A crafted request body can provide an internal or loopback URL, which the server treats as a direct request and therefore skips the private‑IP request‑filtering agent. This allows an unauthenticated attacker to cause the server to fetch and proxy arbitrary content from private networks or cloud metadata services, potentially exposing sensitive internal data.
Affected Systems
ONLYOFFICE DocumentServer versions before 10.0.0 are affected; the issue occurs in all builds where JWT verification is left in its default configuration and the downloadfile endpoint is exposed.
Risk and Exploitability
The CVSS score of 6.3 indicates a medium level of severity, and the EPSS score of 0.00398 (approximately 0.4%) indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw allows unauthenticated remote exploitation by manipulating a request to a public endpoint, the likely attack vector is inferred: an attacker could send a specially crafted POST request to /downloadfile/:docid. Exploitation would give the attacker access to private‑network resources or cloud metadata, potentially leading to data disclosure and further network reconnaissance.
