Уязвимость обхода защиты от выполнения неопределённых скриптов в LibreOffice через атаку с кодированием URL
Описание
В LibreOffice имеется функция, позволяющая выполнять предустановленные макросы при различных событиях, таких как наведение мыши или открытие документа. Доступ к этим макросам должен быть ограничен скриптами, находящимися в подкаталогах share/Scripts/python и user/Scripts/python внутри установки LibreOffice. Ранее была добавлена защита для предотвращения атаки обхода каталогов, обнаруженной в CVE-2018-16858, которая позволяла выполнять скрипты из произвольных расположений файловой системы. Однако эта новая защита может быть обойдена с помощью атаки с кодированием URL. В исправленных версиях URL, описывающий расположение скрипта, корректно кодируется перед дальнейшей обработкой.
Затронутые версии ПО
- Document Foundation LibreOffice версии до 6.2.6
Тип уязвимости
Обход защиты через атаку с кодированием URL
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Issue TrackingMailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- PatchVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Issue TrackingMailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- PatchVendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
LibreOffice has a feature where documents can specify that pre-install ...
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Уязвимость программного модуля LibreLogo пакета офисных программ LibreOffice, позволяющая нарушителю выполнить произвольный код в целевой системе
EPSS
7.8 High
CVSS3
6.8 Medium
CVSS2