CVE-2019-9848
📋 TL;DR
This vulnerability in LibreOffice allows malicious documents to execute arbitrary Python commands silently without user warning. Attackers can embed scripts that trigger when documents are opened or interacted with, leading to remote code execution. It affects LibreOffice versions prior to 6.2.5.
💻 Affected Systems
- LibreOffice
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Libreoffice by Libreoffice
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Malicious document execution leading to data theft, ransomware deployment, or credential harvesting from the victim's system.
If Mitigated
Limited impact if documents are from trusted sources only and macro execution is disabled, though the vulnerability bypasses typical macro warnings.
🎯 Exploit Status
Exploitation requires user to open a malicious document; proof-of-concept details are publicly available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.5 or later
Vendor Advisory: https://www.libreoffice.org/about-us/security/advisories/cve-2019-9848/
Restart Required: No
Instructions:
1. Update LibreOffice to version 6.2.5 or newer via your package manager or official download. 2. For Linux: Use 'sudo apt update && sudo apt upgrade libreoffice' (Debian/Ubuntu) or equivalent. 3. For Windows/macOS: Download and install the latest version from libreoffice.org.
🔧 Temporary Workarounds
Disable LibreLogo
allRemove or disable the LibreLogo feature to prevent script execution.
On Linux: sudo apt remove libreoffice-script-provider-python
On Windows: Uninstall LibreLogo via Add/Remove Programs or disable in Tools > Options > LibreOffice > Advanced
Restrict Document Sources
allOnly open documents from trusted sources and disable automatic script execution.
In LibreOffice: Tools > Options > Security > Macro Security > Set to 'Very High'
🧯 If You Can't Patch
- Use alternative office software that is not vulnerable, such as updated versions of other suites.
- Implement application whitelisting to block LibreOffice execution entirely in high-risk environments.
🔍 How to Verify
Check if Vulnerable:
Check LibreOffice version: In the application, go to Help > About LibreOffice. If version is below 6.2.5, it is vulnerable.Check Version:
libreoffice --version (Linux/macOS) or check via Help menu in GUI.Verify Fix Applied:
After updating, confirm version is 6.2.5 or higher via Help > About LibreOffice. Test with a safe document that previously triggered LibreLogo events.📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from LibreOffice (e.g., python.exe, cmd.exe)
- Log entries showing document events triggering scripts in LibreOffice logs
Network Indicators:
- Outbound connections from LibreOffice process to unknown IPs, potentially indicating command-and-control activity
SIEM Query:
Process creation where parent process contains 'libreoffice' and child process is 'python' or 'cmd'🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html
- http://www.securityfocus.com/bid/109374
- https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPTZJCNN52VNGSVC5DFKVW3EDMRDWKMP/
- https://seclists.org/bugtraq/2019/Aug/28
- https://security.gentoo.org/glsa/201908-13
- https://usn.ubuntu.com/4063-1/
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9848
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html
- http://www.securityfocus.com/bid/109374
- https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPTZJCNN52VNGSVC5DFKVW3EDMRDWKMP/
- https://seclists.org/bugtraq/2019/Aug/28
- https://security.gentoo.org/glsa/201908-13
- https://usn.ubuntu.com/4063-1/
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9848
