CVE-2018-16858

LibreOffice < 6.0.7 and 6.1.3: Directory Traversal, Execute Arbitrary Macros

• CVSS 9.8
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Local

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.

CVE

CVE-2018-16858

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

9.8

Published

2019-03-25

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update LibreOffice to version 6.0.7 or 6.1.3 or higher.

import os

def execute_macro(macro_path):
    """Vulnerable function that demonstrates the security issue."""
    print(f"Executing macro from: {macro_path}")

def open_document_and_execute_macro(doc_path):
    """Vulnerable function that demonstrates the security issue."""
    macro_path = doc_path
    execute_macro(macro_path)

open_document_and_execute_macro('../some/path/to/macro.py')

import os

ALLOWED_DIRECTORY = '/path/to/allowed/macros'

def execute_macro(macro_path):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents path traversal
    print(f"Executing macro from: {macro_path}")

def open_document_and_execute_macro(doc_path):
    """Secure function that fixes the vulnerability."""
    absolute_path = os.path.abspath(doc_path)

    if not absolute_path.startswith(ALLOWED_DIRECTORY):
        raise Exception("Unauthorized file path detected!")

    if os.path.isfile(absolute_path):
        execute_macro(absolute_path)
    else:
        raise Exception("File does not exist or is not a valid file.")

open_document_and_execute_macro('../some/path/to/macro.py')

@misc{vaitp:cve201816858,
  title        = {{LibreOffice < 6.0.7 and 6.1.3: Directory Traversal, Execute Arbitrary Macros}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-16858},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-16858/}}
}