{
  "entrypoint_kind": "open_document",
  "entrypoint_detail": "LibreOffice Calc opens a crafted .fods whose calcext:data-mapping URLs (csv provider, vnd.sun.star.expand scheme) expand the victim's process environment variable (macro ${PRUVA63270_SECRET}) and an INI-file value (macro ${file:///<dir>/secret.ini:Secrets:Token}) and send both expanded values to the remote HTTP listener on document open",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "libreoffice-calc-26.2.4.2 (vulnerable)",
    "libreoffice-calc-26.2.5.2 (fixed control)",
    "python3-http-listener (attacker exfiltration server)"
  ],
  "target_identity": {
    "repository_url": "https://github.com/libreoffice/core",
    "commit_sha": "0229ac93fcf0d7cbc6376066c6f35021cef002dc",
    "target_digest": "810ef197e190d7804a60e0016052c46ff33792303a200fddda9d5216a64b9900",
    "runtime_digest": "9ceb3439812e6196b181d362903d835ebfc0bff09bcc85617f6d5f0cb54bc947",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/server-access.log",
    "repro/proof/vulnerable-1/crafted.fods",
    "repro/proof/vulnerable-1/secret.ini",
    "repro/proof/vulnerable-1/exfil-capture.txt",
    "repro/proof/vulnerable-2/crafted.fods",
    "repro/proof/vulnerable-2/secret.ini",
    "repro/proof/vulnerable-2/exfil-capture.txt",
    "repro/proof/vulnerable-open-1/crafted.fods",
    "repro/proof/vulnerable-open-1/secret.ini",
    "repro/proof/vulnerable-open-1/exfil-capture.txt",
    "repro/proof/fixed-1/crafted.fods",
    "repro/proof/fixed-1/secret.ini",
    "repro/proof/fixed-1/exfil-capture.txt",
    "repro/proof/fixed-2/crafted.fods",
    "repro/proof/fixed-2/secret.ini",
    "repro/proof/fixed-2/exfil-capture.txt",
    "repro/proof/fixed-open-1/crafted.fods",
    "repro/proof/fixed-open-1/secret.ini",
    "repro/proof/fixed-open-1/exfil-capture.txt"
  ],
  "artifact_sha256": {
    "logs/server-access.log": "85aa500c228c6816c399e24109bcc2d475dbd49718cd0ee8647a4039322d3f20",
    "repro/proof/vulnerable-1/crafted.fods": "552e73d159c95e05c19aaabcf34c665ebc4734de63f2eac0c1ddb944ce27dda6",
    "repro/proof/vulnerable-1/secret.ini": "de2545e18eca2c9b486a637104587eb3e7d570511ace49146a5a70e49511662e",
    "repro/proof/vulnerable-1/exfil-capture.txt": "1f42c4e2f96252e9f09463fa432f64b39c927ab2d64081e783fd053428badf1b",
    "repro/proof/vulnerable-2/crafted.fods": "0bb4050e07e4b9f21921063ae6784de7ccfb0df53d4613ed11b0614326373159",
    "repro/proof/vulnerable-2/secret.ini": "d31dd6e8b23bb97ed7a596ec01fe5b2b4af57c901f8f442b2a1ba19120cc418e",
    "repro/proof/vulnerable-2/exfil-capture.txt": "3eb33deaf238ca1ed5ce0d57546533820865d6ceccd635ddf8bbaf51289865df",
    "repro/proof/vulnerable-open-1/crafted.fods": "cf68487203ff46b937e6f4fb522a2fbc599f3e06109440e5d7993c3d9e4bac3c",
    "repro/proof/vulnerable-open-1/secret.ini": "833b4a76f5e30aecfefbf98adae8eae63c6a80050f3785f28ed1403b2ae83ff2",
    "repro/proof/vulnerable-open-1/exfil-capture.txt": "ba34459e318c51d59b8337569931b96cd7e1e61d1dd0656325810ab9b1c35fb5",
    "repro/proof/fixed-1/crafted.fods": "6fe0d197cf2b512c829078109f511e659821b718c28cb1bfd7baaac8b63b4c68",
    "repro/proof/fixed-1/secret.ini": "fd9a7fc21b8244974508154558437dd2cb660f9aefd6baefeb9d2d4a292a8716",
    "repro/proof/fixed-1/exfil-capture.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "repro/proof/fixed-2/crafted.fods": "a13c7151ba4be7b799c189dd02d7771e81b92d467923e2fb435b40883a5aa575",
    "repro/proof/fixed-2/secret.ini": "25186210213a58f8bde59b699e5133c2969577b0124585fe31a701a272b16559",
    "repro/proof/fixed-2/exfil-capture.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "repro/proof/fixed-open-1/crafted.fods": "397551bad58160df478dcb2f52b1c187eda8fd558a7ef3adae8639fa509e89bf",
    "repro/proof/fixed-open-1/secret.ini": "5a1c97f4ee60842523b04d0197b7a07c5f0423d2739c33560ef7db91e27e35e1",
    "repro/proof/fixed-open-1/exfil-capture.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  },
  "notes": "Vulnerable LibreOffice 26.2.4.2 (buildid 0229ac93fcf0d7cbc6376066c6f35021cef002dc, tag libreoffice-26.2.4.2) exfiltrated both a process environment variable and an INI-file value to the HTTP listener when the crafted document was opened (convert-to and direct-open entries); fixed control LibreOffice 26.2.5.2 (buildid cd7284b4cbbfeb507e630c1aac019f4157393acb, tag libreoffice-26.2.5.2) sent nothing. CONFIRMED=yes"
}