Bug 2134697 (CVE-2022-3140)

Summary:	CVE-2022-3140 libreoffice: Macro URL arbitrary script execution
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caolanm, tru
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	LibreOffice 7.3.6, LibreOffice 7.4.1	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in LibreOffice that affects the Office URI Schemes. These schemes enable browser integration of LibreOffice with the MS SharePoint server. In LibreOffice, the links using the scheme 'vnd.libreoffice.command' could be constructed to call internal macros with arbitrary arguments, which, when clicked, or activated by document events, could result in arbitrary script execution without warning. The attacker must trick the targeted individual into opening a malicious file to trigger the exploit.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-25 13:52:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2134698, 2134702, 2134703, 2134704, 2134705, 2134753, 2134761, 2134762
Bug Blocks:	2134078

Description TEJ RATHI 2022-10-14 05:00:15 UTC

CVE-2022-3140 - LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added.

In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning.

Fixed in: LibreOffice 7.3.6/7.4.1
In versions >= 7.3.6 (and >= 7.4.1) such unwanted command URIs are blocked from  execution.

Reference:
https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140

Comment 1 TEJ RATHI 2022-10-14 05:00:42 UTC

Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 2134698]

Comment 6 tru 2022-10-20 12:57:14 UTC

<iframe src='macro:Shell("/usr/bin/xeyes")'></iframe>
triggers the vulnerability on libreoffice-5.3.6.1-25.el7_9.x86_64

Comment 7 errata-xmlrpc 2023-01-12 09:14:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0089 https://access.redhat.com/errata/RHSA-2023:0089

Comment 8 errata-xmlrpc 2023-01-23 15:17:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0304 https://access.redhat.com/errata/RHSA-2023:0304

Comment 9 Product Security DevOps Team 2023-01-25 13:52:13 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3140