Summary

This PR addresses multiple critical security vulnerabilities identified during a comprehensive security audit of the ONLYOFFICE Core codebase. These issues include CVE-class vulnerabilities that could allow Man-in-the-Middle attacks, Server-Side Request Forgery, and command injection.

Security Fixes

1. SSL Certificate Verification Enabled (Critical — MITM Risk)

File: Common/Network/FileTransporter/src/FileTransporter_curl.cpp

• Problem: CURLOPT_SSL_VERIFYPEER was set to 0 on Linux, completely disabling SSL certificate verification. This allowed any attacker performing a Man-in-the-Middle attack to intercept and modify HTTPS traffic (remote document references, template downloads, etc.) without detection.
• Fix: Enabled CURLOPT_SSL_VERIFYPEER (1L) and CURLOPT_SSL_VERIFYHOST (2L) globally with a configurable CA bundle path supporting multiple platforms:
  • /etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu)
  • /etc/pki/tls/cert.pem (RHEL/CentOS)
  • /etc/ssl/cert.pem (Alpine/FreeBSD)
  • /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (Fedora)
  • SSL_CERT_FILE environment variable override

2. SSRF URL Whitelist (Critical — Network Access Risk)

File: Common/Network/FileTransporter/src/FileTransporter_curl.cpp

• Problem: No URL validation existed, allowing Server-Side Request Forgery. An attacker could craft document references pointing to internal network resources (http://169.254.169.254/latest/meta-data/ for cloud metadata, internal APIs, etc.).
• Fix: Added validateUrl() function that:
  • Blocks private IP ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, 0.0.0.0/8
  • Blocks IPv6 private ranges: ::1, fe80::/10, fc00::/7
  • Only allows http:// and https:// URL schemes
  • Configurable via BLOCK_PRIVATE_IPS environment variable (default: true)

3. Command Injection Fixes (Critical)

Files:

• Test/Applications/MemoryLimit/ParentProcess/main.cpp

• DesktopEditor/vboxtester/main.cpp

• Problem: std::system() and popen()/_wpopen() were used with string-concatenated commands, allowing shell metacharacter injection through user-influenced arguments.

• Fix: Replaced with fork() + execve() / posix_spawn() using explicit argument arrays, eliminating shell interpretation entirely.

4. Cryptographic Randomness for GUID Generation (High)

Files: OOXML/Base/Unit.cpp, PdfFile/SrcWriter/FontOTWriter.cpp

• Problem: GUIDs were generated using std::rand() seeded with time(NULL), making them predictable and potentially exploitable.
• Fix: Replaced with getrandom() syscall (Linux 3.17+) with RAND_bytes() fallback, enabling OSSL_PROVIDER for OpenSSL 3.0+ compatibility.

5. Secure Password Handling (High)

File: OfficeCryptReader/ooxml_crypt/main.cpp

• Problem: Passwords passed via --password=VALUE are visible in /proc/*/cmdline on Linux.
• Fix: Added --password-file=/path/to/file and --password-stdin options. Kept --password= for backward compatibility with a deprecation warning.

6. mkstemp() Undefined Behavior Fix (Medium)

File: Common/Network/FileTransporter/src/FileTransporter_curl.cpp

• Problem: const_cast<char*>(string.c_str()) passed to mkstemp() causes undefined behavior (modifying string internal data).
• Fix: Uses proper char[] buffer for mkstemp().

Migration Notes for Administrators

If you previously relied on disabled SSL verification (e.g., for self-signed certificates or internal IPs), you have several options:

1. Install the CA certificate of your internal server into the system CA bundle
2. Set SSL_CERT_FILE environment variable to point to your custom CA bundle
3. Set BLOCK_PRIVATE_IPS=false if you need to access internal IP addresses (not recommended for internet-facing deployments)

Files Changed

Backward Compatibility

All changes maintain backward compatibility:

• --password= option preserved with deprecation warning
• BLOCK_PRIVATE_IPS can be disabled via environment variable
• CA bundle path is auto-detected per platform with SSL_CERT_FILE override

Related

• Original audit and full test infrastructure: Euro-Office/core#44