CVE-2019-9850

LibreOffice vulnerability, insufficient URL validation, allows malicious script execution

• CVSS 9.8
• CWE-20 Improper Input Validation
• Input Validation and Sanitization
• Remote

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.

CVE

CVE-2019-9850

CWE

CWE-20 Improper Input Validation

CVSS base score

9.8

Published

2019-08-15

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update LibreOffice to version 6.2.6 or higher.

def execute_script(script):
    """Vulnerable function that demonstrates the security issue."""
    exec(script)

execute_script("import os; os.system('rm -rf /')")

def execute_script(script):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    blacklist = ['import', 'exec', 'eval', 'os', 'subprocess', '__', 'open', 'input', 'system']
    for keyword in blacklist:
        if keyword in script:
            raise ValueError(f"Blacklisted keyword detected: {keyword}")
    
    exec(script)

try:
    execute_script("import os; os.system('rm -rf /')")
except ValueError as e:
    print(e)

@misc{vaitp:cve20199850,
  title        = {{LibreOffice vulnerability, insufficient URL validation, allows malicious script execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-9850},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-9850/}}
}