CVE-2023-2255 PoC — Remote documents loaded without prompt via IFrame

Source

https://github.com/SaintMichae64/CVE-2023-2255

Associated Vulnerability

Title: Remote documents loaded without prompt via IFrame (CVE-2023-2255)
Description:Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Readme

Command to execute the creation of the exploit:

sudo python3 starkelevate.py /home/bob/Downloads/librecommand.exe --output librecommand.odt

educational purposes only

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →