CVE-2022-26307

What it actually does

The master key used to encrypt stored web connection passwords is encoded with reduced entropy (43 bits instead of 128), enabling brute-force attacks on the key if the configuration database is accessible.

Why it matters to the business

Attackers with access to user configuration files can recover stored passwords for web services, potentially leading to unauthorized access to connected accounts and data breaches across affected deployments.

How an attack unfolds

An attacker gains access to the user's LibreOffice configuration database containing the encrypted passwords. They then brute-force the weakened master key to decrypt and retrieve the stored credentials for use in further attacks.

How to fix it

Upgrade LibreOffice to 7.2.7 or later on the 7.2 branch and to 7.3.3 or later on the 7.3 branch. Disable the password storage feature until patches are applied if immediate upgrade is not feasible.

How to confirm the fix worked

Confirm installed LibreOffice versions meet or exceed 7.2.7 or 7.3.3. Review configuration files for stored credentials and validate that master key encoding uses full entropy post-update.

Typical attack path

1. Obtain access to the target user's LibreOffice configuration files
2. Extract the encrypted passwords and master key material from the database
3. Perform offline brute-force attack against the 43-bit key
4. Decrypt recovered passwords and leverage them for unauthorized access

How to detect it

Review filesystem access logs and audit trails for reads of LibreOffice configuration database files by unexpected processes or users. Search for indicators of offline password recovery attempts or mass decryption of stored credentials.

What your security team should do

• Apply available updates to all LibreOffice installations immediately
• Audit user configuration databases for any stored web passwords
• Disable password storage functionality where possible
• Restrict filesystem access to user configuration directories