PT-2023-13981 · Unknown · Openrefine

Ixsly · Published 2023-08-04 · Updated 2023-08-08 · CVE-2022-41401

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenRefine versions 3.5.2 and earlier

Description The issue allows unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure due to a Server-Side Request Forgery (SSRF) vulnerability.

Recommendations For OpenRefine versions 3.5.2 and earlier, update to a version later than 3.5.2 to resolve the issue. As a temporary workaround, consider restricting access to internal resources to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-41401

GHSA-Q7MC-FC87-V7W7

Affected Products

Openrefine

References · 14

• 🔥 https://github.com/ixSly/CVE-2022-41401 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-41401 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41401 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41401 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41401 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7mc-fc87-v7w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41401 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41401 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41401 · Vendor Advisory
• https://github.com/OpenRefine/OpenRefine/blob/30d6edb7b6586623bda09456c797c35983fb80ff/main/tests/server/src/com/google/refine/importing/ImportingUtilitiesTests.java#L180 · Note
• https://github.com/OpenRefine/OpenRefine/blob/cb55cdfdf6f9ca916839778dc847cce803688998/main/src/com/google/refine/importing/ImportingUtilities.java#L103 · Note
• https://github.com/OpenRefine/OpenRefine/commit/8cb2fec45dd90fda8ed9608c691f6bb8ed721cd2 · Note
• https://github.com/OpenRefine/OpenRefine · Note
• https://t.me/cibsecurity/67769 · Telegram Post