T07 · Tool Hijacking and Spoofing
Error
- Location
- recalc.py:26
- Finding
- Untrusted Pre-existing LibreOffice Macro Is Executed Without Integrity Validation## Vulnerability Details **File Location**: `recalc.py`, lines 26-29 and 70-75 **Vulnerability Type**: Untrusted local tool and macro hijacking **Risk Level**: High ### Vulnerable Code ```python if os.path.exists(macro_file): with open(macro_file, 'r') as f: if 'RecalculateAndSave' in f.read(): return True ``` ```python cmd = [ 'soffice', '--headless', '--norestore', 'vnd.sun.star.script:Standard.Module1.RecalculateAndSave?language=Basic&location=application', abs_path ] ``` ### Technical Analysis The script trusts an existing application-level LibreOffice macro solely because its source contains the substring `RecalculateAndSave`. It does not verify the complete macro body, file ownership, permissions, origin, or cryptographic integrity. The subsequent `soffice` invocation executes `Standard.Module1.RecalculateAndSave` from the application macro location. Consequently, an attacker who can modify the user's LibreOffice profile can replace the expected recalculation macro with arbitrary LibreOffice Basic logic while preserving the expected procedure name or text. The substring test then accepts the malicious module, and the script executes it as if it were trusted. This is a tool-hijacking weakness rather than an independent privilege escalation: the malicious macro runs with the operating-system permissions of the user who invokes `recalc.py`. ### Attack Path 1. An attacker, compromised local process, or malicious package obtains write access to the invoking user's LibreOffice profile. 2. The attacker creates or modifies `Module1.xba` under the applicable `Standard` macro directory. 3. The malicious module contains the text or procedure name `RecalculateAndSave`, ensuring that the weak validation at lines 26-29 succeeds. 4. The user or agent follows the documented workflow and runs `python recalc.py workbook.xlsx`. 5. The script invokes the application-level `S ...[truncated 744 chars]
- Remediation
- ## Remediation Suggestions - Do not execute a macro from the user's persistent, application-level LibreOffice profile. - Create a dedicated temporary LibreOffice profile for each run and launch LibreOffice with an isolated `UserInstallation`, such as `-env:UserInstallation=file:///path/to/temporary/profile`. - Install a uniquely named macro only in that isolated profile and remove the entire profile after execution. - If reuse of a macro is unavoidable, validate the complete file against a cryptographic digest of a known-good macro rather than searching for a procedure-name substring. - Verify that macro directories and files are owned by the expected user and are not writable by other users. - Use a unique module and procedure name to reduce collision and hijacking opportunities. - Fail closed if the macro content or execution environment differs from the expected configuration.