spaceraccoon 🦝 | Eugene Lim September 18, 2021 More to come on CVE-2021-38646 Microsoft Office RCE. Just talked about it at #hacktivitycon and full writeup at. At this point, he can run whatever he wants on the victim's machine.ĬVE-2021-33035: RCE in Apache OpenOffice up to 4.1.10 - pure memory corruption. Because the overwritten pointer he'd obtained offered only about 256 bytes to work with, his ROP chain became GetModuleHandleA and then GetProcAddress to locate the WinExec code to execute his own shell commands. ROP, as Lim explained, is a technique that chains together snippets of code that resides within an application's memory – like cutting out letters from newspapers and magazines to spell out a sentence, but in this case it's lining up software instructions to execute – until a specific goal has been accomplished.

'So I could use this library as a starting point for a return-oriented programming chain, or ROP chain, in order to bypass DEP eventually,' he said. To do so, he looked for imported modules that had not been compiled with those protections and found libxml2, a software library for parsing XML documents. To fully exploit this and achieve reliable code execution, on Windows at least, Lim had to bypass DEP and ASLR.

Revising his previous payload generator to the integer fieldType ( I), he increased the size of fieldLength to greater than sal_Int32, and was able to launch a proof-of-concept attack that consisted of opening the file in OpenOffice Calc and causing a crash. 'Next, memcpy copies a buffer of size nLen - which is an attacker-controlled value - into nValue without validating that nLen is smaller than or equal to 4.'

'Here, we can see a buffer nValue of size sal_Int32 (4 bytes) being instantiated for a field of type INTEGER,' explained Lim in a blog post.

Open office apache software