denylist of executable filename extensions possible to bypass under windows
CVE-2021-25631

8.8HIGH

Key Information:

Vendor

The Document Foundation

Status
Libreoffice
Vendor
CVE Published:
3 May 2021

What is CVE-2021-25631?

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.

Affected Version(s)

LibreOffice Windows 7.1 < 7.1.2

LibreOffice Windows 7.0 < 7.0.5

References

https://positive.security/blog/url-open-rce#open-libreoffice
x_refsource_MISC
https://www.libreoffice.org/about-us/security/advisories/...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lukas Euler of Positive Security
JSON
.