CVE-2025-24796: Collabora Online RCE Vulnerability

CVE-2025-24796 Overview

CVE-2025-24796 affects Collabora Online, a collaborative online office suite based on LibreOffice. When an administrator enables macro support, the software allows macros to run executable binaries. Combined with the default net.lok_allow configuration that permits downloads from private IP ranges, an attacker can host malicious executables on the local network, deliver them through a crafted document, and execute them inside the document jail. The issue is tracked under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
An attacker who convinces a user to open a crafted document on a macro-enabled instance can install and execute arbitrary binaries within the Collabora Online jail, expanding the attack surface beyond the default network restrictions.

Affected Products

Collabora Online versions prior to 24.04.12.4
Collabora Online versions prior to 23.05.19
Collabora Online versions prior to 22.05.25

Discovery Timeline

2025-03-06 - CVE-2025-24796 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24796

Vulnerability Analysis

Collabora Online executes each document instance inside a sandboxed jail. The net.lok_allow configuration option governs which network locations the jail can reach. By default, this allowlist includes private IP ranges so that documents can access resources on the local network.

When an administrator enables macro support, macros gain the ability to invoke executable binaries. An attacker can combine these two behaviors. First, the attacker hosts a malicious binary on a system reachable through the default private-network allowlist. Second, the attacker delivers a document containing a macro that downloads the binary and executes it inside the jail.

Execution is limited to the jail file system and the user account running the document instance. The attacker gains a foothold that bypasses the intended network-access limits, however, and can pivot to hosts outside the original allowlist. This provides a stable platform for further reconnaissance or exploitation.

Root Cause

The root cause is the combination of two permissive defaults acting together. The jail permits network fetches from private IP ranges through net.lok_allow, and macro support, when enabled, permits arbitrary binary execution. Neither behavior alone is sufficient, but together they allow untrusted binaries to be introduced into a trusted execution context.

Attack Vector

The attack requires macro support to be enabled on the target Collabora Online instance and requires a user to open a malicious document. The attacker also needs the ability to host a payload on a network location that the jail is permitted to reach, which by default includes the local network. See the GitHub Security Advisory GHSA-4jjq-vgqp-qw45 for the vendor's technical description.

Detection Methods for CVE-2025-24796

Indicators of Compromise

Unexpected outbound HTTP or HTTPS requests from Collabora Online jail processes targeting hosts on the local network
New executable files written under the per-document jail directory tree
Child processes spawned by the Collabora Online document process that are not part of the standard runtime

Detection Strategies

Monitor process creation events where the parent process belongs to Collabora Online and the child is an unrecognized binary path
Alert on file writes to jail directories that produce files with the executable bit set
Correlate document open events with subsequent network fetches to internal IP ranges defined in net.lok_allow

Monitoring Recommendations

Enable verbose logging on the Collabora Online host to capture macro execution and network fetch activity
Forward host process, file, and network telemetry to a centralized analytics platform for retrospective hunting
Baseline normal Collabora Online child-process behavior so that anomalous binary executions surface quickly

How to Mitigate CVE-2025-24796

Immediate Actions Required

Upgrade to Collabora Online 24.04.12.4, 23.05.19, 22.05.25, or later
Disable macro support unless it is required for a documented business workflow
Review the net.lok_allow configuration and remove private IP ranges that are not strictly necessary

Patch Information

The vendor addressed CVE-2025-24796 in Collabora Online 24.04.12.4, 23.05.19, and 22.05.25. Refer to the Collabora Online security advisory GHSA-4jjq-vgqp-qw45 for release details and upgrade guidance.

Workarounds

Keep macro support disabled at the administrator level, which is the shipped default
Restrict net.lok_allow to explicit hosts required by the deployment rather than broad private IP ranges
Place the Collabora Online host in a network segment that cannot reach internal services offering executable content

bash

# Configuration example: tighten net.lok_allow in coolwsd.xml
# Replace permissive private-range entries with explicit allowed hosts
<net>
  <lok_allow desc="Hosts the jail may fetch content from" type="string">
    https://docs.internal.example.com/
  </lok_allow>
</net>

# Ensure macros remain disabled unless required
<user_interface>
  <macro_security desc="Macro security level" type="string">high</macro_security>
</user_interface>