A Prank With a Point

For my Software Exploitation assessment at the University of Chester, I needed to demonstrate a real-world vulnerability in a controlled, ethical environment. Most people default to dry slideshows and technical writeups. I chose a different path — one that ended with Rick Astley singing to my entire class.

The vulnerability in question: CVE-2019-9848, a critical flaw in LibreOffice that allows arbitrary Python code execution via a simple mouse hover. No clicks. No downloads. Just hover over text, and the attacker owns your browser.

⚠️ Educational Disclaimer
This demonstration was conducted in a controlled academic environment under faculty supervision. The techniques described here are shared strictly for educational purposes. Always practice ethical hacking legally and responsibly.

What is CVE-2019-9848?

LibreOffice ships with a feature called LibreLogo — a turtle-graphics programming environment baked right into the word processor. What the developers didn't adequately restrict is that LibreLogo macros can call arbitrary Python code, and those macros can be silently triggered by mouse events embedded in document hyperlinks.

Translation: craft a document, embed a hyperlink, assign a macro to the “Mouse Over Object” event, and anyone who opens the file and hovers their cursor over that text executes your Python payload. Zero clicks required.

import webbrowser
webbrowser.open('https://youtu.be/dQw4w9WgXcQ')

# Two lines. That's all it takes.

NIST rated this vulnerability CVSS 9.8 — Critical. In real-world attacks, the payload wouldn't launch a YouTube video; it could silently exfiltrate credentials, install ransomware, or establish a reverse shell.

Step-by-Step: Building the Trap

Write the Payload in LibreOffice Writer — Open a blank LibreOffice Writer document inside a VM. Type the two-line Python payload directly into the document body — the import and webbrowser.open call. This becomes the script that fires on hover.
Create the Hyperlink Trigger — Select the decoy text (“Run”) and insert a hyperlink pointing to a LibreLogo script URL. This is the bait — innocent looking text that secretly carries the macro.
Assign the Macro to Mouse Over Event — Use the Assign Macro dialog to bind the LibreLogo script to the “Mouse over object” event. This is the key step — no click needed, just a hover.
Save as .ODT and Distribute — Save the document in ODT format (LibreOffice's native format) to preserve the macro bindings. The file is now weaponized and ready to be opened by victims.
Watch the Chaos Unfold — The moment a victim opens the document and hovers their mouse over the hyperlink text — Rick Astley appears, playing at full volume, in their browser.

LibreOffice Writer with Python payload code — **Step 1:** The two-line Python payload typed directly into LibreOffice Writer. Simple, devastating. `import webbrowser` + `webbrowser.open(rickroll_url)`.

LibreOffice Hyperlink dialog with LibreLogo URL — **Step 2:** The Hyperlink dialog — assigning a LibreLogo script URL to the innocent “Run” text. This is where the trap is set.

Assign Macro dialog showing Mouse over object event — **Step 3:** The critical step — the “Assign Macro” dialog, binding the LibreLogo script to the **Mouse over object** event. No clicks required from the victim.

Saving the document as ODT — **Step 4:** Saving the malicious document. ODT format preserves macro bindings.

File Explorer showing the saved ODT file — **Step 4b:** The completed .ODT file — innocent looking, ready to deploy.

Never Gonna Give You Up

🎵 Never Gonna Give You Up
youtube.com/watch?v=dQw4w9WgXcQ — triggered without a single click

The reaction in the room was exactly what I'd hoped for — first confusion, then laughter, then the dawning realisation that something genuinely dangerous had just happened. A real attacker wouldn't have launched a YouTube video. They could have silently:

Launched a reverse shell
Exfiltrated credentials or files
Downloaded and executed ransomware
Recorded keystrokes or screen activity

The prank made the risk viscerally real in a way that a CVE description on a slide never could.

What This Teaches Us

Keep Your Software Updated

This vulnerability was patched in LibreOffice 6.2.5 and 6.3.1. If your organisation is still running older versions of LibreOffice, you are exposed. Patch management isn't glamorous work, but this is exactly why it matters.

Macro Security Settings Are Not Optional

LibreOffice's macro security settings should be set to “High” or “Very High” in any environment where untrusted documents are opened. This prevents unsigned macros from executing automatically.

Zero Interaction Exploits Are the Scariest Kind

The most dangerous attacks require no action from the victim beyond opening a file. No “enable macros” prompt. No phishing link to click. Just hover. This should fundamentally change how you think about opening documents from unknown sources.

🔒 Mitigation Checklist
Update LibreOffice to 6.2.5+ or 6.3.1+ · Set macro security to High · Never open untrusted ODT/ODP/ODS files · Use sandboxed document viewers in enterprise environments

Written for the University of Chester — Software Exploitation Assessment
Special thanks to Prof. Toyosi Oyinloye for the mentorship & guidance
For educational purposes only · Practice ethical hacking responsibly · Always get written permission