CERT/CC published advisory VU#943094 on September 8, 2026, about a server-side request forgery (SSRF) vulnerability in the ONLYOFFICE integration plugin for ownCloud version 9.12, developed by Ascensio System SIA. The vulnerability, registered as CVE-2026-84282, allows an authenticated administrator to force the ownCloud server to perform arbitrary outbound network requests to attacker-controlled addresses, including internal resources and localhost. At the time of publication, no official patch exists — CERT/CC reports that it was unable to contact the vendor. Organizations using this plugin are advised to disable or remove it immediately.
Technical details of the vulnerability
The ONLYOFFICE plugin for ownCloud provides document editing functionality directly within the cloud storage environment. When configuring the connection to the ONLYOFFICE document server, the plugin accepts a URL via the /apps/onlyoffice/ajax/settings/address endpoint and initiates a connection to the specified address directly from the ownCloud server.
According to CERT/CC, the application does not restrict or sanitize this parameter. An authenticated administrator can specify arbitrary URLs, including internal network addresses or localhost (127.0.0.1) that are not accessible from the outside. Outbound requests are executed on behalf of the ownCloud server, which is a classic case of SSRF.
An additional risk arises from a side channel based on differences in server responses. As CERT/CC describes, the difference between connection errors and SSL/TLS negotiation errors allows an attacker to determine the state of TCP ports — whether they are open or closed. This makes it possible to conduct internal network reconnaissance and port enumeration using the ownCloud server as a proxy.
It is important to note that exploitation requires authenticated access with administrator privileges to the ownCloud management console. This significantly narrows the circle of potential attackers, but does not eliminate the risk — a compromised administrator account or an insider with corresponding privileges could exploit the vulnerability.
Impact assessment
According to CERT/CC, successful exploitation allows an attacker to:
- Initiate arbitrary outbound network requests on behalf of the ownCloud server
- Access services on localhost that are not reachable from outside
- Conduct internal network reconnaissance and port scanning via response-based side channels
- Use the ownCloud infrastructure as a proxy to send malicious content to target systems
- Expand the attack surface for subsequent exploitation of internal services
The highest risk is faced by organizations that have deployed ownCloud with the ONLYOFFICE plugin in corporate networks where the ownCloud server has access to internal resources — databases, internal service APIs, and infrastructure management systems. In such environments, an SSRF vulnerability can become an entry point for lateral movement.
At the time of publication, CERT/CC has no information on active exploitation of this vulnerability, and no public exploit code has been found. A CVSS score has not been assigned.
Practical recommendations
CERT/CC notes that no official patch is available and that no response has been received from the vendor. Under these circumstances, the following measures are recommended:
- Disable or remove the ONLYOFFICE plugin from ownCloud until a fixed version is released. This is the most reliable way to eliminate the vulnerability.
- Restrict outbound connections from the ownCloud server at the network level. Firewall rules should allow outbound traffic only to explicitly authorized addresses, blocking access to internal subnets and localhost.
- Implement monitoring of administrative requests to the
/apps/onlyoffice/ajax/settings/addressendpoint. Correlating such requests with subsequent outbound connections from the ownCloud server to addresses in the loopback range (127.0.0.0/8), private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or other atypical destinations may indicate an exploitation attempt. - Audit ownCloud administrator accounts: ensure there are no excessive privileges and enable multi-factor authentication for administrative access.
The vulnerability has been confirmed by CERT/CC for version 9.12 of the plugin. The published advisory does not state whether other versions are affected, so conclusions should not be generalized to other versions without additional data.
Organizations using the ONLYOFFICE plugin for ownCloud version 9.12 should disable it immediately and enforce outbound traffic restrictions at the network level. The lack of response from the vendor makes the timeline for a patch uncertain, so relying on a prompt fix is unwise — protective measures must be implemented independently.
