PT-2023-8178 · Apache · Apache Openoffice

Amel Bouziane-Leblond + 1 · Published 2023-12-28 · Updated 2024-01-11 · CVE-2023-47804

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to the fixed version

Description The issue is related to insufficient input validation when processing arguments, allowing a remote attacker to execute arbitrary code. Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments using several URI Schemes. These links can be activated by clicks or automatic document events and should require user approval. However, in the affected versions, certain links do not request approval, potentially resulting in arbitrary script execution.

Recommendations For Apache OpenOffice versions prior to the fixed version, consider disabling the execution of internal macros with arbitrary arguments until a patch is available. Restrict access to documents that may contain such links to minimize the risk of exploitation. As a temporary workaround, require user approval for all links that call internal macros. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Argument Injection

Weakness Enumeration

CWE-20

CWE-88

Related Identifiers

BDU:2024-00163

CVE-2023-47804

Affected Products

Apache Openoffice

References · 16

• https://lists.apache.org/thread/ygp59swfcy6g46jf8v9s6qpwmxn8fsvb · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47804 · Security Note
• https://openoffice.org/security/cves/CVE-2023-47804.html · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2023-12-29.1.pdf · Security Note
• https://bdu.fstec.ru/vul/2024-00163 · Security Note
• https://t.me/secharvester/15118 · Telegram Post
• https://t.me/true_secator/5270 · Telegram Post
• http://openwall.com/lists/oss-security/2024/01/03/3 · Note
• https://vuldb.com/ru/?id.249244 · Note
• https://t.me/cvenotify/66659 · Telegram Post
• https://twitter.com/CVEnew/status/1740744408641806838 · Twitter Post
• https://t.me/cibsecurity/73990 · Telegram Post
• https://openwall.com/lists/oss-security/2024/01/03/3 · Note
• https://twitter.com/oss_security/status/1740514882938908976 · Twitter Post