CVE-2021-43445
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceONLYOFFICE Document Server uses JWT authentication to protect its web socket service. The vulnerability allows an attacker to bypass this authentication mechanism by using a known default JWT signing key that ships with the software. This enables unauthorized access to the document editing web socket service.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 7.0.0.49CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check installed Onlyoffice Server versionDetermine the installed version of Onlyoffice Document Server using system commands, package manager, or the built-in about pageAffected if Version is 7.0.0.49 or lower
-
Locate JWT configurationFind the JWT configuration file in the Onlyoffice documentserver configuration directory (typically /etc/onlyoffice/documentserver/)Affected if JWT configuration file exists and contains secret/key settings
-
Inspect JWT signing keyOpen the JWT configuration file and examine the jwt.secret or similar key parameter valueAffected if The configured JWT signing key matches the default key that ships with the software (the well-known default value) rather than a unique custom secret
-
Verify web socket service exposureConfirm the web socket service (ws/wss on the configured port) is accessible and inspect whether JWT validation is enforcedAffected if The web socket endpoint responds and accepts connections using the default JWT signing key
Environment is affected if running Onlyoffice Server version 7.0.0.49 or lower AND the default JWT signing key is still in use in the configuration.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedChange the default JWT signing key to a unique, strong secret in the ONLYOFFICE configuration and ensure it is not exposed or guessable.
7.1.0 or later
- 1. Upgrade ONLYOFFICE Server to version 7.1.0 or later (a version beyond the vulnerable 7.0.0.49 release).
- 2. After upgrading, locate the JWT secret configuration in the ONLYOFFICE Server settings (typically in the configuration files or web panel).
- 3. Change the default JWT signing key to a strong, unique secret value that is not publicly known or guessable.
- 4. Restart the ONLYOFFICE services to apply the new configuration.
- 5. Verify that the JWT authentication is working correctly with the new key.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation2.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,072.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-43445 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-43445 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data