CVE-2024-6472
📋 TL;DR
This vulnerability in LibreOffice's certificate validation UI could allow users to inadvertently run malicious signed macros when certificate verification fails. The interface previously didn't clearly communicate verification failures, potentially leading users to enable macros anyway. This affects LibreOffice users running versions 24.2 through 24.2.4.
💻 Affected Systems
- LibreOffice
📦 What is this software?
Libreoffice by Libreoffice
⚠️ Risk & Real-World Impact
Worst Case
User executes malicious macro thinking it's properly signed, leading to full system compromise, data theft, or ransomware deployment.
Likely Case
User accidentally enables a macro with invalid certificate, potentially executing unwanted code or scripts.
If Mitigated
User sees clear warning and rejects the macro, preventing execution of potentially malicious content.
🎯 Exploit Status
Exploitation requires user to open a malicious document and choose to enable macros despite verification failure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.2.5 or later
Vendor Advisory: https://www.libreoffice.org/about-us/security/advisories/CVE-2024-6472
Restart Required: Yes
Instructions:
1. Open LibreOffice
2. Go to Help → Check for Updates
3. Follow prompts to update to 24.2.5 or later
4. Restart LibreOffice after update
🔧 Temporary Workarounds
Disable macro execution
allPrevent all macros from running regardless of signature status
Tools → Options → Security → Macro Security → Set to 'Very High' (no macros)
User training
allTrain users to never enable macros from untrusted sources
🧯 If You Can't Patch
- Disable macro execution entirely in LibreOffice settings
- Use alternative office software temporarily
- Implement application whitelisting to block LibreOffice
🔍 How to Verify
Check if Vulnerable:
Check LibreOffice version in Help → About LibreOfficeCheck Version:
libreoffice --version (Linux/macOS) or check About dialog (Windows)Verify Fix Applied:
Confirm version is 24.2.5 or higher in Help → About LibreOffice📡 Detection & Monitoring
Log Indicators:
- LibreOffice crash logs
- System logs showing unexpected process execution after LibreOffice use
Network Indicators:
- Unexpected outbound connections after opening documents
SIEM Query:
source="libreoffice" AND (event="macro_execution" OR event="certificate_verification_failure")