CVE-2026-84282 Overview
CVE-2026-84282 is a Server-Side Request Forgery (SSRF) vulnerability in the ONLYOFFICE ownCloud Integration plugin version 9.12. The flaw resides in the /apps/onlyoffice/ajax/settings/address endpoint, which fails to validate user-supplied Document Server URLs before initiating outbound HTTP connections. An authenticated administrator can supply arbitrary destinations, including localhost and internal network hosts, causing the ownCloud server to issue requests on their behalf. Attackers can leverage response differences to perform internal reconnaissance and TCP port scanning against systems otherwise unreachable from outside the perimeter.
Critical Impact
Authenticated administrators can pivot through the ownCloud server to probe internal networks, enumerate services, and map infrastructure that should not be exposed externally.
Affected Products
- ONLYOFFICE ownCloud Integration plugin version 9.12
- ownCloud deployments using the affected plugin version
- Environments exposing the /apps/onlyoffice/ajax/settings/address endpoint
Discovery Timeline
- 2026-09-08 - CVE-2026-84282 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-84282
Vulnerability Analysis
The vulnerability is a classic Server-Side Request Forgery (SSRF) affecting the settings API of the ONLYOFFICE integration for ownCloud. When an administrator submits a Document Server URL through the settings interface, the backend controller settingsapicontroller.php uses the supplied value to open an outbound connection intended to verify the Document Server. The plugin does not restrict the target host to permitted external Document Server endpoints. As a result, the ownCloud application becomes a proxy for arbitrary outbound requests originating from its own network position.
Because the request executes from the server, the destination host observes the ownCloud host as the source. Attackers exploit this trust boundary to reach internal-only services, cloud metadata endpoints, and loopback interfaces. Differences in HTTP status codes, response bodies, and timing enable inference of open ports and running services on internal hosts.
Root Cause
The root cause is missing validation of the documentserver parameter in the settings endpoint. The plugin trusts administrator input as a benign configuration value rather than treating it as data that dictates the target of a server-initiated request. There is no allowlist enforcement, no scheme restriction, and no protection against RFC 1918 or loopback addresses.
Attack Vector
An authenticated administrator sends a POST request to /apps/onlyoffice/ajax/settings/address with the documentserver parameter set to an internal URL such as http://127.0.0.1:8080 or http://10.0.0.5:22. The ownCloud server issues the connection attempt and returns response indicators that reveal whether the target port is open, closed, or filtered. Iterating across IP ranges and ports enables full internal reconnaissance. See the ONLYOFFICE settings controller source and CERT Vulnerability Advisory #943094 for technical details.
Detection Methods for CVE-2026-84282
Indicators of Compromise
- Repeated POST requests to /apps/onlyoffice/ajax/settings/address from a single administrator session within a short window
- Outbound connection attempts from the ownCloud server to RFC 1918 addresses, loopback interfaces, or cloud metadata IPs such as 169.254.169.254
- Unusual documentserver parameter values referencing non-standard ports or internal hostnames
Detection Strategies
- Parse ownCloud application logs for administrator interactions with the ONLYOFFICE settings endpoint and correlate against normal configuration change frequency
- Inspect egress firewall and proxy logs for outbound requests originating from the ownCloud host to internal ranges
- Alert on HTTP client User-Agent strings associated with the ONLYOFFICE plugin targeting non-Document Server destinations
Monitoring Recommendations
- Enable verbose logging for the ONLYOFFICE plugin controllers and forward events to a central SIEM
- Establish a baseline of legitimate Document Server hostnames and alert on deviations
- Monitor administrator account activity for anomalous configuration changes outside change-management windows
How to Mitigate CVE-2026-84282
Immediate Actions Required
- Restrict administrative access to the ownCloud instance and review all accounts with the administrator role
- Place the ownCloud server behind an egress proxy that enforces an allowlist of approved Document Server hosts
- Audit recent use of the /apps/onlyoffice/ajax/settings/address endpoint for unexpected documentserver values
Patch Information
No vendor patch reference is listed in the NVD entry for CVE-2026-84282 at the time of publication. Monitor the ONLYOFFICE ownCloud integration repository and CERT Vulnerability Advisory #943094 for updates and apply fixed plugin releases as soon as they become available.
Workarounds
- Block outbound traffic from the ownCloud server to internal network ranges and loopback addresses at the network layer
- Deploy egress filtering rules that permit only known Document Server destinations on required ports
- Temporarily disable the ONLYOFFICE integration plugin if patching is not immediately possible and the integration is non-essential
# Example egress allowlist using iptables to permit only the approved Document Server
iptables -A OUTPUT -o eth0 -d 203.0.113.25 -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -o eth0 -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -o eth0 -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -o eth0 -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -o eth0 -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
