CVE-2024-5261

What it actually does

Disables TLS certificate verification (CURLOPT_SSL_VERIFYPEER=false) in curl when LibreOfficeKit mode is active, allowing unsigned or forged certificates for remote resource fetches.

Why it matters to the business

Attackers can intercept or alter documents and images fetched during conversion or viewing workflows, risking data exposure or malware insertion in document processing pipelines used by third-party applications.

How an attack unfolds

An attacker performs a man-in-the-middle attack on network traffic between LibreOfficeKit and a remote server hosting images or other resources; because certificate validation is disabled, the client accepts the attacker's certificate and retrieves attacker-controlled content that is then incorporated into the processed document.

How to fix it

Upgrade LibreOffice to version 24.2.4 or later on all affected systems; after upgrade, confirm LibreOfficeKit uses the same TLS verification behavior as standard mode.

How to confirm the fix worked

Verify installed LibreOffice version is 24.2.4 or newer; test by attempting to fetch a remote resource served with an invalid certificate and confirm the connection is rejected.

Typical attack path

1. Position as network MITM between the host and remote resource server
2. Present a forged or invalid TLS certificate for the requested domain
3. LibreOfficeKit initiates curl request with verification disabled
4. Malicious or altered content is fetched and embedded into the document
5. Resulting document is delivered to the end user or downstream system

How to detect it

Review application and system logs for curl requests initiated from LibreOfficeKit processes; look for remote resource fetches that complete without certificate validation errors on hosts running vulnerable versions.

What your security team should do

• Prioritize upgrade to LibreOffice 24.2.4 or later across all deployments using LibreOfficeKit
• Audit third-party applications that embed LibreOfficeKit for document conversion or viewing
• Monitor network traffic for unexpected certificate validation failures or unusual remote fetches from document-processing hosts