CVE-2023-47804
📋 TL;DR
Apache OpenOffice documents can contain malicious links that execute internal macros with arbitrary arguments without user approval. This allows arbitrary script execution when activated by clicks or automatic document events. All users running affected OpenOffice versions are vulnerable.
💻 Affected Systems
- Apache OpenOffice
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment when a user opens a malicious document.
Likely Case
Malicious document execution leading to malware installation, credential theft, or lateral movement within the network.
If Mitigated
No impact if proper patching and security controls prevent malicious document execution.
🎯 Exploit Status
Exploitation requires user interaction but is technically simple; weaponization likely due to document-based attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache OpenOffice 4.1.15
Vendor Advisory: https://www.openoffice.org/security/cves/CVE-2023-47804.html
Restart Required: Yes
Instructions:
1. Download OpenOffice 4.1.15 or later from official Apache site. 2. Uninstall previous version. 3. Install new version. 4. Restart system.
🔧 Temporary Workarounds
Disable macro execution
allConfigure OpenOffice to disable macro execution entirely.
Not applicable - configure via Tools > Options > Security > Macro Security > Set to 'Very High'
Use LibreOffice instead
allSwitch to LibreOffice which is not affected and actively maintained.
sudo apt install libreoffice (Linux)
Download from https://www.libreoffice.org/ (Windows/macOS)
🧯 If You Can't Patch
- Block OpenOffice documents at email/web gateways; implement application allowlisting to prevent OpenOffice execution.
- Educate users to never open documents from untrusted sources; implement least privilege to limit damage.
🔍 How to Verify
Check if Vulnerable:
Check OpenOffice version via Help > About OpenOffice; if version is below 4.1.15, system is vulnerable.Check Version:
OpenOffice --version (Linux/macOS) or check via GUI on WindowsVerify Fix Applied:
Confirm version is 4.1.15 or higher in Help > About OpenOffice; test with safe document containing macros.📡 Detection & Monitoring
Log Indicators:
- OpenOffice process spawning unexpected child processes
- Macro execution logs in OpenOffice
Network Indicators:
- Outbound connections from OpenOffice to unexpected destinations
SIEM Query:
process_name:"soffice.bin" AND child_process:*🔗 References
- http://www.openwall.com/lists/oss-security/2024/01/03/3
- https://lists.apache.org/thread/ygp59swfcy6g46jf8v9s6qpwmxn8fsvb
- https://www.openoffice.org/security/cves/CVE-2023-47804.html
- http://www.openwall.com/lists/oss-security/2024/01/03/3
- https://lists.apache.org/thread/ygp59swfcy6g46jf8v9s6qpwmxn8fsvb
- https://www.openoffice.org/security/cves/CVE-2023-47804.html
