CVE-2023-25266

Deeper analysis

Docmosis Tornado versions prior to 2.9.5 contain a vulnerability that allows an authenticated attacker to modify the Office directory configuration setting to point at an arbitrary remote network path. This change causes the application to execute the soffice binary from the attacker-controlled location, resulting in arbitrary remote code execution.

An attacker with valid credentials can exploit the flaw over the network without user interaction. Successful exploitation grants full control over the affected system, including the ability to read, modify, or delete data and execute arbitrary commands with the privileges of the Tornado process.

The official Tornado v2.9.5 release notes document the fix for this issue and are available from the vendor. The vulnerability was also detailed in public analysis that identified it among other flaws affecting environments using the software. The associated EPSS score has remained low and stable since disclosure, with a current value of 0.0570 and a peak of 0.0588.