Listen to this Post
The vulnerability is an improper input validation flaw in the hyperlink handling mechanism of LibreOffice on Windows. LibreOffice has a feature where hyperlinks in a document can be activated by a CTRL+click. When activated, the link target is passed to the Windows system `ShellExecute` function for processing. To prevent security risks, LibreOffice employs a mechanism designed to block paths that lead directly to executable files (like .exe files) from being sent to ShellExecute. In affected versions (prior to 24.8.5), this protective mechanism could be bypassed. An attacker could craft a special hyperlink using a non-file URL scheme that, when processed, would be incorrectly interpreted by `ShellExecute` as a valid Windows file path to an executable. This bypass meant that the usual safeguards were ineffective, allowing the unconditional execution of the linked target when a user activated the malicious hyperlink within a document.
dailycve form
Platform: LibreOffice
Version: 24.8 to <24.8.5
Vulnerability: Improper Input Validation
Severity: High
date: 2025-02-25
Prediction: 2025-02-25
What Undercode Say:
Check local LibreOffice version on Linux/macOS libreoffice --version Check for vulnerable versions (example logic) if [[ "$LO_VERSION" < "24.8.5" ]]; then echo "Vulnerable"; fi
<!-- Conceptual example of a malicious hyperlink structure --> <a href="crafted://non-file-url/C:/Windows/system32/calc.exe">Click Here</a>
How Exploit:
An attacker embeds a specially crafted hyperlink into a document. The link uses a non-file URL that bypasses LibreOffice’s filter for executable paths. When a victim opens the document and activates the link via CTRL+click, the link is passed to Windows ShellExecute. `ShellExecute` misinterprets the crafted URL as a local file path to an executable. The executable (e.g., malware) runs unconditionally on the victim’s system.
Protection from this CVE
Upgrade to LibreOffice version 24.8.5 or later.
Impact:
Allows arbitrary code execution on the Windows host. Compromises confidentiality, integrity, and availability (CVSS 3.1: C:H/I:H/A:H). Requires user interaction (clicking the link).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
