CVE-2020-11534

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server version 5.5.0

Description An issue was discovered that allows an attacker to craft a malicious .docx file and exploit the NSFileDownloader function. This exploitation enables the attacker to pass parameters to a binary, such as curl or wget, and remotely execute code on a victim's server.

Recommendations For ONLYOFFICE Document Server version 5.5.0, as a temporary workaround, consider disabling the NSFileDownloader function until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.