CVE-2024-47882 OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
OpenRefine's error page fails to escape HTML, allowing attackers to inject scripts via malicious project imports, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47882?
CVE-2024-47882 is a medium-severity cross-site scripting vulnerability in OpenRefine, published on 24 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult. However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.
Which versions are affected by CVE-2024-47882?
2 open source packages ship an affected version, including org.openrefine:openrefine. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.openrefine:openrefine Maven | All versions | 3.8.3 |
org.openrefine:openrefine Maven | All versions | 3.8.3 |
Products include Openrefine Openrefine.
How do I fix CVE-2024-47882?
Upgrade org.openrefine:openrefine to 3.8.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47882 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47882 exists.
Other vulnerabilities in OpenRefine
- CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack
- CVE-2024-47878 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
- CVE-2024-47880 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
- CVE-2024-47881 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
- CVE-2024-47879 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
Sources
Also known as DEBIAN-CVE-2024-47882, GHSA-j8hp-f2mj-586g, UBUNTU-CVE-2024-47882.