CVE-2024-47881 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
An attacker with network access can enable SQLite extension loading to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47881?
CVE-2024-47881 is a high-severity code injection vulnerability in OpenRefine, published on 24 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Version 3.8.3 fixes this issue.
Weakness: CWE-89
Which versions are affected by CVE-2024-47881?
2 open source packages ship an affected version, including org.openrefine:database. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.openrefine:database Maven | From 3.4-beta | 3.8.3 |
org.openrefine:database Maven | From 3.4-beta | 3.8.3 |
Products include Openrefine Openrefine.
How do I fix CVE-2024-47881?
Upgrade org.openrefine:database to 3.8.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-47881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47881 exists.
Other vulnerabilities in OpenRefine
- CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack
- CVE-2024-47878 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
- CVE-2024-47880 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
- CVE-2024-47879 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
- CVE-2024-23833 OpenRefine JDBC Attack Vulnerability
Sources
Also known as DEBIAN-CVE-2024-47881, GHSA-87cf-j763-vvh8, UBUNTU-CVE-2024-47881.