CVE-2022-38745

What it actually does

The vulnerability allows configuration of an empty entry in the Java class path, enabling execution of arbitrary Java code from the current working directory when OpenOffice processes documents.

Why it matters to the business

Attackers could execute malicious code on affected systems, leading to data breaches, system compromise, or further attacks within the network. The issue has been public for over three years with low exploit activity, keeping overall risk moderate but requiring prompt attention for organizations still running older versions.

How an attack unfolds

An attacker prepares a document or configuration that forces OpenOffice to add an empty classpath entry. When the victim opens the file from a directory containing attacker-placed Java classes, the runtime loads and executes the malicious code under the user's privileges.

How to fix it

Upgrade Apache OpenOffice to version 4.1.14 or later, which removes the ability to add empty classpath entries.

How to confirm the fix worked

Confirm the installed OpenOffice version is 4.1.14 or higher; test in a lab environment that class loading from the current directory no longer occurs for crafted documents.

Typical attack path

1. Prepare a malicious document or OpenOffice configuration that triggers an empty Java classpath entry
2. Place attacker-controlled Java class files in the target user's current working directory
3. Use social engineering to convince the user to open the document
4. Java runtime loads classes from the current directory and executes the payload

How to detect it

Review process creation logs for OpenOffice spawning Java with unexpected classpath arguments or loading classes from user-controlled directories; inspect recent file activity in directories where documents are opened for unknown .class files.

What your security team should do

• Immediately upgrade all Apache OpenOffice installations to 4.1.14 or newer
• Audit and harden Java runtime settings used by OpenOffice across the environment
• Block execution of unexpected Java classes from user-writable directories via application control
• Provide user awareness training on handling unsolicited documents