4 ms·

Since docx files are similar to a zip file with the extension changed, could this trick fake out Microsoft Word?

mlyle 1y ago
The trick depends upon different implementations doing different things. Not likely for Word (though I suppose it is -possible- across different versions or different OSes).
- netsharc 1y ago
  To respond to Grandfather comment, modern Office files are really just ZIPs with different extensions, they even have the magic string "PK" at the very beginning of the file. I do wonder, since a lot of tools outside of the MS ecosystem can read Office files (e.g. LibreOffice and Google Docs as well as plenty of other online tools), if indeed the hack as described by the article is possible. One would just need to figure out the ZIP stacks used by said tools.
  - saghm 1y ago
    You can even just rename a docx file to use the zip extension and then manually unzip it for those curious. If I remember correctly, the contents are XML files with structure encoding the formatting around the content.
- larschdk 1y ago
  The Office365 online and desktop implementations of zip could be different.
- hnlmorg 1y ago
  It’s very common for organisations to only give expensive MS Office licenses to a subset of employees while the rest rely on O365 or Google Docs. Then you have people on Linux or macOS who might also use LibreOffice, Apples Office suite, or something else entirely. And given MS Office is the de facto standard, you’ll often see people open OOXML documents within non-MS office suites. After all, OOXML is an open standard (sarcasm). ODF (the document formats favoured by most other office suites) is also ZIP-based XML. So they too could be vulnerable.
- sltkr 1y ago
  docx is supposed to be a portable format. There are many tools other than Word that open them. Just LibreOffice and Google Docs for example. They might well differ from Word or from each other in how they handle this case. Definitely worth testing!
JdeBP 1y ago
It's an interesting hole that the test cases don't cover any of Microsoft Office, Windows Explorer, PowerShell's various cmdlets, or the several major .NET ZIP archive libraries. It would seem that the author just does not use Microsoft Windows. There's a whole extra level of archive file format tooling gotchas that one misses out on when one assumes "UNIX" for everything, and does not account for "FAT", "NTFS", "HPFS", and even "OpenVMS". Or ZIP64. (-: * https://github.com/dotnet/runtime/blob/main/src/libraries/System.IO.Compression/src/System/IO/Compression/ZipArchive.cs#L666 https://github.com/dotnet/runtime/blob/main/src/libraries/Sy... * https://github.com/mihula/ProDotNetZip/blob/main/src/Zip/ZipFile.Read.cs#L640 https://github.com/mihula/ProDotNetZip/blob/main/src/Zip/Zip...
justsomehnguy 1y ago
> As everything looks good, you forward the ZIP with the invoice to the payment team Nope, because a typical accounting asset wouldn't make it and you know it so you forward the PDF to them.

The trick depends upon different implementations doing different things. Not likely for Word (though I suppose it is -possible- across different versions or different OSes).

netsharc 1y ago
To respond to Grandfather comment, modern Office files are really just ZIPs with different extensions, they even have the magic string "PK" at the very beginning of the file. I do wonder, since a lot of tools outside of the MS ecosystem can read Office files (e.g. LibreOffice and Google Docs as well as plenty of other online tools), if indeed the hack as described by the article is possible. One would just need to figure out the ZIP stacks used by said tools.
- saghm 1y ago
  You can even just rename a docx file to use the zip extension and then manually unzip it for those curious. If I remember correctly, the contents are XML files with structure encoding the formatting around the content.
larschdk 1y ago
The Office365 online and desktop implementations of zip could be different.
hnlmorg 1y ago
It’s very common for organisations to only give expensive MS Office licenses to a subset of employees while the rest rely on O365 or Google Docs. Then you have people on Linux or macOS who might also use LibreOffice, Apples Office suite, or something else entirely. And given MS Office is the de facto standard, you’ll often see people open OOXML documents within non-MS office suites. After all, OOXML is an open standard (sarcasm). ODF (the document formats favoured by most other office suites) is also ZIP-based XML. So they too could be vulnerable.
sltkr 1y ago
docx is supposed to be a portable format. There are many tools other than Word that open them. Just LibreOffice and Google Docs for example. They might well differ from Word or from each other in how they handle this case. Definitely worth testing!

JdeBP 1y ago

It's an interesting hole that the test cases don't cover any of Microsoft Office, Windows Explorer, PowerShell's various cmdlets, or the several major .NET ZIP archive libraries. It would seem that the author just does not use Microsoft Windows. There's a whole extra level of archive file format tooling gotchas that one misses out on when one assumes "UNIX" for everything, and does not account for "FAT", "NTFS", "HPFS", and even "OpenVMS". Or ZIP64. (-: * https://github.com/dotnet/runtime/blob/main/src/libraries/System.IO.Compression/src/System/IO/Compression/ZipArchive.cs#L666 https://github.com/dotnet/runtime/blob/main/src/libraries/Sy... * https://github.com/mihula/ProDotNetZip/blob/main/src/Zip/ZipFile.Read.cs#L640 https://github.com/mihula/ProDotNetZip/blob/main/src/Zip/Zip...

justsomehnguy 1y ago

> As everything looks good, you forward the ZIP with the invoice to the payment team Nope, because a typical accounting asset wouldn't make it and you know it so you forward the PDF to them.