CVE-2023-50883

2024-09-0900:00:00

mitre

github.com

onlyoffice

docs

xss

vulnerability

macro

sandbox

escape

constructor

function object

incorrect fix

AI Score

6.4

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:onlyoffice:docs:*:*:*:*:*:*:*:*"
    ],
    "vendor": "onlyoffice",
    "product": "docs",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "8.0.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]