CVE-2024-6472: LibreOffice Auth Bypass Vulnerability

CVE-2024-6472 Overview

CVE-2024-6472 affects the certificate validation user interface in LibreOffice. The vulnerability resides in how the application presents signed macro verification failures to users. When a document containing a signed macro is opened, LibreOffice displays a warning before executing the macro. Prior to the fix, users encountering a verification failure could misinterpret the warning and choose to enable the macros regardless. This user interface weakness maps to improper certificate validation [CWE-295]. The issue affects LibreOffice versions from 24.2 before 24.2.5.

Critical Impact

Attackers can leverage misleading certificate validation dialogs to convince users to execute malicious signed macros, leading to local code execution with full impact on confidentiality, integrity, and availability.

Affected Products

• LibreOffice 24.2 through versions before 24.2.5
• The Document Foundation LibreOffice (desktop productivity suite)
• All operating systems supported by the affected LibreOffice builds

Discovery Timeline

• 2024-08-05 - CVE-2024-6472 published to the National Vulnerability Database (NVD)
• 2025-12-10 - Last updated in NVD database

Technical Details for CVE-2024-6472

Vulnerability Analysis

The vulnerability stems from how LibreOffice communicates signed macro verification failures through its certificate validation user interface. Signed macros are scripts cryptographically signed by their developer. LibreOffice verifies the signature when the document is opened and displays a warning dialog before executing any macro code.

When verification fails, the previous dialog implementation did not clearly distinguish between a successfully validated signature and a failed one. A user could misread the warning and grant execution permission to a macro whose signature could not be trusted. The flaw classifies as Improper Certificate Validation [CWE-295] because the trust decision presented to the user did not accurately reflect the cryptographic verification result.

Successful exploitation results in arbitrary macro code running with the privileges of the user opening the document. This gives an attacker the ability to access files, execute commands, and tamper with data accessible to that user.

Root Cause

The root cause is a user interface design defect in the macro signature warning dialog. The dialog presented signature failure states in a manner that allowed users to proceed without understanding that the cryptographic verification had failed. The application logic deferred the trust decision to the user without conveying the failed state clearly.

Attack Vector

Exploitation requires local user interaction. An attacker crafts a document containing a malicious macro signed with an invalid, untrusted, or tampered signature. The attacker then delivers the document through email, file sharing, or a compromised website. When the victim opens the document in a vulnerable LibreOffice build, the misleading verification dialog can be misinterpreted, leading the user to enable macros and trigger code execution. No network access or elevated privileges are required to launch the attack.

No public proof-of-concept or exploit code is currently available for CVE-2024-6472. Refer to the LibreOffice Security Advisory CVE-2024-6472 for vendor-supplied technical context.

Detection Methods for CVE-2024-6472

Indicators of Compromise

• Office documents (.odt, .ods, .odp, .docx, .xlsx) containing embedded macros with invalid or untrusted digital signatures
• LibreOffice child processes (soffice.bin) spawning interpreters such as cmd.exe, powershell.exe, bash, or python shortly after document open
• Unexpected outbound network connections initiated by soffice.bin following document execution
• New persistence artifacts (scheduled tasks, registry Run keys, cron entries) created in user context after opening a signed-macro document

Detection Strategies

• Monitor process lineage for soffice.bin parenting scripting hosts or shells, a strong signal of macro-driven code execution
• Inspect email gateways and file shares for Office documents containing macros and flag those with broken or self-signed certificate chains
• Correlate document-open telemetry with subsequent file writes to user-writable directories (%APPDATA%, /tmp, ~/.config)

Monitoring Recommendations

• Enable command-line and process-creation logging on endpoints running LibreOffice to capture macro-triggered execution chains
• Audit LibreOffice macro security settings centrally and alert on downgrades from High or Very High to Medium or Low
• Aggregate endpoint, email, and proxy telemetry in a centralized analytics platform to correlate document delivery with post-open behavior

How to Mitigate CVE-2024-6472

Immediate Actions Required

• Upgrade LibreOffice to version 24.2.5 or later on all endpoints in the 24.2 branch
• Configure macro security to High or Very High so unsigned and untrusted-signed macros are blocked by default
• Educate users to reject any macro prompt that references a failed or unverifiable signature
• Inventory hosts running affected LibreOffice builds and prioritize patching for users who routinely handle external documents

Patch Information

The Document Foundation fixed CVE-2024-6472 in LibreOffice 24.2.5. The patch revises the certificate validation user interface to clearly communicate failed signature states and removes ambiguous trust prompts. Patch details are available in the LibreOffice Security Advisory CVE-2024-6472.

Workarounds

• Disable macro execution entirely through Tools > Options > LibreOffice > Security > Macro Security and select Very High
• Restrict trusted macro sources to a managed allowlist of internal signing certificates
• Block inbound Office documents containing macros at the email gateway when business workflows allow

# Configuration example: enforce highest macro security via the LibreOffice registrymodifications.xcu
# Place under each user profile: ~/.config/libreoffice/4/user/registrymodifications.xcu
<item oor:path="/org.openoffice.Office.Common/Security/Scripting">
  <prop oor:name="MacroSecurityLevel" oor:op="fuse">
    <value>3</value>
  </prop>
</item>