CVE-2020-11537: 
ONLYOFFICE DocumentServer vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2020-11537) was discovered in ONLYOFFICE Document Server 5.5.0, disclosed on April 15, 2020. The vulnerability affects the Websocket API component of the application, specifically the DocID parameter, which allows attackers to execute arbitrary SQL queries (NIST NVD, GitHub Advisory).

The vulnerability is classified as a SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 9.8 (CRITICAL) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue allows attackers to execute arbitrary SQL queries by injecting malicious SQL strings into the DocID parameter of the Websocket API. For example, an attacker can concatenate SQL injection strings like 'UNION SELECT 1,2 FROM pg_sleep(10);--' to the DocID parameter (NIST NVD, GitHub Advisory).

The vulnerability has severe implications for system security as it allows unauthorized access to the database through SQL injection. This can lead to unauthorized information disclosure, data manipulation, and potential system compromise. The CVSS score of 9.8 indicates critical severity with high impact on confidentiality, integrity, and availability of the system (NIST NVD).

The vulnerability is remotely exploitable and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted SQL injection strings to the DocID parameter in the Websocket API. The attack vector has been documented with specific examples of malicious SQL queries that can be used to exploit the vulnerability (GitHub Advisory).

The vulnerability was addressed in subsequent versions of ONLYOFFICE Document Server. Users are advised to upgrade from version 5.5.0 to a patched version of the software (ONLYOFFICE Changelog).