OnlyOffice is a comprehensive open-source office suite used by enterprises, educational institutions, and non-profits for collaborative document editing, project management, and business communication. It supports popular file formats like DOCX, PPTX, and XLSX, making it a versatile tool for organizations seeking data privacy and customization. The platform is deployed on-premises or in the cloud, serving as a central hub for workflow efficiency.
The Setup Wizard Page Exposure vulnerability occurs when the installation wizard (Wizard.aspx) remains accessible after initial setup. This oversight allows unauthorized users to access the configuration interface, potentially leading to reinstallation or modification of critical settings. The vulnerability arises from improper access controls or failure to remove the wizard after deployment.
Technically, the scanner targets the /wizard/Wizard.aspx endpoint, which is used during OnlyOffice's initial configuration. If left exposed, an attacker can interact with this page to view or alter database connections, admin credentials, and other sensitive parameters. The vulnerability is rated CVSS 8.0 due to its high impact on confidentiality and integrity.
Exploitation could allow attackers to reset administrative accounts, change database configurations, or inject malicious settings. This compromises the entire OnlyOffice instance, leading to data breaches, service disruption, or unauthorized access to documents. Organizations risk significant operational and reputational damage if this exposure is not addressed.
- Remove or restrict access to the Wizard.aspx file after initial setup is complete.
- Implement IP whitelisting or VPN requirements for accessing the setup wizard.
- Use web application firewalls (WAF) to block external requests to the wizard endpoint.
- Regularly audit server configurations to ensure no setup pages are publicly accessible.
- Apply strong authentication mechanisms, such as multi-factor authentication, for any administrative interfaces.
- Monitor logs for unauthorized attempts to access the setup wizard and set up alerts.
- Educate system administrators on secure deployment practices for OnlyOffice.
- Consider using a reverse proxy to restrict access to sensitive paths.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →