Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ONLYOFFICE/server
master @ d6df308
59
Fixes
6
CVEs
CRITICAL
Peak severity
48.6%
Coverage
Highlights
Auth Bypass: 16 prior fixes. Scrutinize any change in this area.
DocService/sources/DocsCoServer.js: most-fixed (11 issues). Treat as high-risk during review.
39 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The project suffers from repeated authentication bypasses and permission tampering vulnerabilities in its socket connection handler and document state handlers, stemming from insufficient validation of JWT tokens and incomplete deep-equality checks on claims. Strict schema enforcement and structural validation of tokens are vital.
SSRF: The AI proxy hander and document comparison systems have frequently bypassed private network boundaries or allowed arbitrary destination dispatch due to weak URL matching and incomplete enforcement of host allowlists and IP filters.
Path Traversal: Path traversal risks occur across document save paths, static routing components, and conversion download services due to inadequate sanitization of user-controlled parameters like document IDs or index values, leading to potential arbitrary file writes outside sandbox environments.