CVE-2019-9852
📋 TL;DR
CVE-2019-9852 is a directory traversal vulnerability in LibreOffice that allows attackers to bypass URL encoding protections and execute arbitrary Python scripts from unauthorized locations. This affects LibreOffice versions prior to 6.2.6 and could lead to remote code execution when users open malicious documents.
💻 Affected Systems
- LibreOffice
📦 What is this software?
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Libreoffice by Libreoffice
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the LibreOffice user, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Execution of malicious scripts leading to data exfiltration, credential theft, or installation of backdoors when users open specially crafted documents.
If Mitigated
Limited impact if macros are disabled by policy or if documents are opened in sandboxed environments with restricted permissions.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious document) but the vulnerability is straightforward to exploit once a malicious document is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.6 and later
Vendor Advisory: https://www.libreoffice.org/about-us/security/advisories/cve-2019-9852/
Restart Required: No
Instructions:
1. Update LibreOffice to version 6.2.6 or later using your distribution's package manager or official installer. 2. For Linux: sudo apt update && sudo apt upgrade libreoffice (Debian/Ubuntu) or sudo yum update libreoffice (RHEL/CentOS). 3. For Windows/macOS: Download and install latest version from libreoffice.org.
🔧 Temporary Workarounds
Disable macro execution
allPrevent LibreOffice from executing any macros, which blocks exploitation of this vulnerability.
Tools → Options → Security → Macro Security → Set to 'Very High' (disable all macros)
Restrict document sources
allOnly open documents from trusted sources and avoid opening unexpected Office documents.
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized LibreOffice execution
- Use sandboxing solutions to run LibreOffice in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check LibreOffice version: Help → About LibreOffice. If version is below 6.2.6, system is vulnerable.Check Version:
libreoffice --version (Linux/macOS) or check Help → About (Windows)Verify Fix Applied:
Verify version is 6.2.6 or higher in Help → About LibreOffice. Test with known safe macro-enabled documents to ensure functionality remains.📡 Detection & Monitoring
Log Indicators:
- Unusual macro execution events in LibreOffice logs
- Execution of Python scripts from unexpected locations
Network Indicators:
- Outbound connections from LibreOffice process to unexpected destinations after document opening
SIEM Query:
process_name:"soffice.bin" AND (event_type:"process_execution" OR cmdline:"python")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/
- https://seclists.org/bugtraq/2019/Aug/28
- https://seclists.org/bugtraq/2019/Sep/17
- https://usn.ubuntu.com/4102-1/
- https://www.debian.org/security/2019/dsa-4501
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9852
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/
- https://seclists.org/bugtraq/2019/Aug/28
- https://seclists.org/bugtraq/2019/Sep/17
- https://usn.ubuntu.com/4102-1/
- https://www.debian.org/security/2019/dsa-4501
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9852
