File Exfiltration via LibreOffice in BigBlueButton and JODConverter

blog.hboeck.de

32 points·hannob··5 comments

Not surprised. Worked at a company where we did document conversion on sites we hosted for customers. The whole thing was done on a machine that got burned to the ground and reset after every document it converted. The machine was set up to have no sensitive data and couldn’t connect to anything.

We had to roll out the feature slowly because of how much resources it consumed just to convert some documents.

These days I’m sure setting up and tearing down containers / VMs is a bit faster, but it was a bit slow back in the day.

https://github.com/QubesOS/qubes-app-linux-pdf-converter

It's really fast.

Doesn’t look like it does the same thing, to be honest.

- Bitmap only (major problems with search and accessibility)

- Doesn’t use Microsoft Office (hard requirement for many)

We had separate offering that used LibreOffice (or one of its predecessors) which ran in a much faster, more light-weight system. The version that used MS Office was a paid add-on.

Out of curiosity, what kinds of clients did that project have?

A number of different clients, all corporate, a few names you heard of. The idea behind using MS Office is that someone can upload a Word document, you can find it by searching for text inside the document, and you can see a preview that looks like it does in Word.

Reply on news.ycombinator.com