erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: January 22, 2021

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: ONLYOFFICE Docs CVE-2021-3199: Old Upload RCE Now in KEV. Anyone self-hosting ONLYOFFICE Document Server (Docs) 5.6.2 or older, alone or behind Nextcloud, ownCloud, Seafile, Confluence, Moodle or another connector, especially internet-reachable instances with JWT enabled.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2021-3199

ONLYOFFICE Docs CVE-2021-3199: Old Upload RCE Now in KEV

Only Document Server installs older than 5.6.3, a release from August 2020, are at risk, but any you find should be treated as exposed and upgraded or pulled offline today.

Must act: Anyone self-hosting ONLYOFFICE Document Server (Docs) 5.6.2 or older, alone or behind Nextcloud, ownCloud, Seafile, Confluence, Moodle or another connector, especially internet-reachable instances with JWT enabled.

Can relax: Teams on Document Server 5.6.3 or later (10.0.0 is current), and teams that do not run their own ONLYOFFICE Docs server.

  1. Find every Document Server you run: docker ps and docker image ls for onlyoffice/documentserver, or dpkg -l / rpm -q onlyoffice-documentserver.
  2. Upgrade anything older than 5.6.3 to a current release; if that is not possible today, take the instance off the internet.
  3. Set a long random JWT secret and rotate it in every connected app (Nextcloud, ownCloud, Seafile and others); never keep the old default value secret.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.