CVE-2022-26306

What it actually does

The encryption of stored web connection passwords uses a static initialization vector, weakening the cipher and allowing decryption of passwords if an attacker obtains the user's configuration database and the master key.

Why it matters to the business

Attackers with access to configuration files may recover stored credentials for external services, leading to unauthorized access to connected systems and potential data exposure; the issue has been public for over four years with slowly rising exploit likelihood.

How an attack unfolds

An attacker first obtains a copy of the user's configuration database containing the encrypted passwords. Because the initialization vector is constant and known, standard cryptographic attacks can be mounted against the encrypted data once the master key or sufficient ciphertext is available, revealing the original passwords.

How to fix it

Upgrade LibreOffice to version 7.2.7 or later for the 7.2 branch and 7.3.1 or later for the 7.3 branch. For affected OpenNMS deployments, apply the fix from commit 9feb41d9ff697443b9b77bdcfa8e618b1350ed76.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed releases listed above and verify that new password entries in the configuration database use unique initialization vectors.

Typical attack path

1. Gain read access to the target user's configuration database or exported settings file
2. Locate the encrypted password entries and note the fixed initialization vector
3. Obtain or brute-force the master key protecting the encryption
4. Decrypt the stored passwords using the known IV and recovered key
5. Use recovered credentials to access external web services or accounts

How to detect it

Review system logs and file access records for unauthorized reads of the LibreOffice or OpenNMS configuration database or user profile directories; look for processes or scripts that parse or export stored connection passwords.

What your security team should do

• Prioritize patching all instances to the fixed versions immediately given the four-year public disclosure window
• Audit configuration database access controls to limit exposure of stored credentials
• Rotate any passwords that were previously stored under the vulnerable encryption scheme
• Monitor EPSS trend and reassess exploit maturity quarterly