LibreOffice Repair Mode Vulnerability Let Attackers Mark the Document as Not Valid

LibreOffice users are urged to update their software after disclosing a critical vulnerability, CVE-2024-7788, which affects the document repair mode.

This flaw allows attackers to manipulate document signatures, potentially leading to security breaches.

Vulnerability Overview

LibreOffice, a popular open-source office suite, supports various file formats that rely on the zip file structure.

When these files become corrupted, LibreOffice’s repair mode attempts to recover the document by reconstructing the zip file structure. However, a vulnerability in this process has been identified. 

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

Before the recent fix, attackers could exploit this repair mechanism by crafting a document that, once repaired, incorrectly reported a digital signature status as “not valid.” This could mislead users into trusting tampered-with documents.

The vulnerability primarily affects digitally signed zip files. An attacker could create a corrupted document that, when opened in LibreOffice’s repair mode, would bypass signature verification. This means users might inadvertently enable macros or trust content that could be malicious. 

In previous versions of LibreOffice, users could ignore verification failures and proceed with enabling macros.

This behavior posed significant security risks, as malicious macros could execute harmful code on a user’s system.

Fix and Recommendations

LibreOffice versions 24.2.5 and 24.8.0 address the vulnerability. In these updated versions, all signatures are automatically deemed invalid when a document is opened in repair mode. This change ensures that potentially compromised documents do not mislead users.

CVE-2024-7788 highlights the importance of robust security measures in software applications.

The swift response from the LibreOffice team underscores their commitment to user safety and data integrity.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14-day free trial