CVE-2020-27603 PoC — BigBlueButton 安全漏洞

Source

https://github.com/hannob/CVE-2020-27603-bbb-libreoffice-poc

Associated Vulnerability

Title:BigBlueButton 安全漏洞 (CVE-2020-27603)
Description:BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.

Description

Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button

Readme

# CVE-2020-27603-bbb-libreoffice-poc
Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button

These ODT files show how to exploit a file exfiltration vulnerability that can happen
with server-side Libreoffice rendering, e.g. BigBlueButton.

Background:
* https://blog.hboeck.de/archives/902-File-Exfiltration-via-Libreoffice-in-BigBlueButton-and-JODConverter.html
* https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!