LibreOffice Vulnerable to Code Execution in URL Mouseover Preview Feature

Researcher Alex Inführ discovered that LibreOffice 6.1.0-6.1.3.1 is susceptible to a code injection attack if a user hovers their mouse over a malicious URL.

背景說明

Researcher Alex Inführ disclosed a LibreOffice vulnerability (CVE-2018-16858) in versions 6.1.0-6.1.3.1 which shows that code injection is possible on both Linux and Windows versions when a user hovers their mouse over a malicious URL.

Update: Tenable Research was able to confirm that this vulnerability is also exploitable on macOS by editing the Proof of Concept (PoC) code.

分析

While this vulnerability does require user interaction, an OpenDocument Text (ODT) file containing a malicious URL is not likely to be flagged by most corporate security defenses. There isn’t any malicious code or otherwise altered elements to the document. It wouldn’t be seen as malware, and the text can be changed to the same color as the document background to make it invisible to the average user.

Furthermore, when the vulnerability is exploited, it doesn’t generate a warning dialogue of any kind. As soon as the user hovers over the malicious URL, the code is executed immediately. The current Still (Stable) Branch of LibreOffice (6.0.7) is not susceptible to this vulnerability.

Below is the researcher’s Proof of Concept video demonstrating an invisible URL opening a command prompt on the vulnerable version:

解決方法

LibreOffice addressed this vulnerability in release 6.1.3.2, and upgrading to that version or later should mitigate the vulnerability.

找出受影響的系統

A list of Nessus plugins to identify this vulnerability can be found here as they're released.

取得更多資訊

• Libreoffice (CVE-2018-16858) - Remote Code Execution via Macro/Event execution
• Latest Versions of LibreOffice

加入 Tenable Community 的 Tenable 安全回應團隊。

深入瞭解 Tenable，這是用於全面管理新型攻擊破綻的首創 Cyber Exposure 平台。

Get a free 60-day trial of Tenable.io Vulnerability Management.