CVE-2019-9852

LibreOffice : Macro Execution Bypass

• CVSS 7.8
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.

CVE

CVE-2019-9852

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.8

Published

2019-08-15

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update LibreOffice to version 6.2.6 or higher.

import urllib.parse
import os

def execute_script(encoded_script_path):
    """Vulnerable function that demonstrates the security issue."""
    script_path = urllib.parse.unquote(encoded_script_path)

    exec(open(script_path).read())

import urllib.parse
import os

DIRECTORY = '/path/to/scripts'
BLACKLIST = ['..', '/etc', 'passwd', 'shadow', 'system']

def check_script(script_path):
    """Secure function that fixes the vulnerability."""
    normalized_path = os.path.normpath(script_path)
    if not normalized_path.startswith(DIRECTORY):
        return False
    for blocked in BLACKLIST:
        if blocked in normalized_path:
            return False
    return True

def execute_script(encoded_script_path):
    """Secure function that fixes the vulnerability."""
    script_path = urllib.parse.unquote(encoded_script_path)
    if not check_script(script_path):
        raise ValueError("Attempted to execute an unsafe or blacklisted script.")
    with open(script_path) as file:
        exec(file.read())

@misc{vaitp:cve20199852,
  title        = {{LibreOffice : Macro Execution Bypass}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-9852},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-9852/}}
}