PT-2023-28144 · Unknown+2 · Mysql Connector/J+4

Nbxiglk0 · Published 2023-09-12 · Updated 2025-02-10 · CVE-2023-41887

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.7.5

Description A remote code execution issue allows any unauthenticated user to execute code on the server. This is possible due to a vulnerability in the way OpenRefine handles certain database connections, specifically when using the mysql-connector-java version less than 8.20. The vulnerability can be exploited by injecting parameters into the connection string, allowing for deserialization and potentially leading to remote code execution. The presence of a commons-beanutils dependency library on the server side, which contains an RCE-capable deserialization exploit chain, further exacerbates the issue.

Recommendations For OpenRefine versions prior to 3.7.5, update to version 3.7.5 or later to patch the remote code execution vulnerability. As a temporary workaround, consider restricting access to the mysql-connector-java and disabling the autoDeserialize and queryInterceptors parameters in the connection string to minimize the risk of exploitation. Avoid using the user and dataBaseName parameters in the affected connection string until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-41887

GHSA-P3R5-X3HR-GPG5

USN-7260-1

Affected Products

Linuxmint

Openrefine

Ubuntu

Commons-Beanutils

Mysql Connector/J

References · 24

• 🔥 https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41887.json · Exploit
• https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511 · Patch
• https://ubuntu.com/security/CVE-2024-47882 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47881 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-41887 · Security Note
• https://osv.dev/vulnerability/USN-7260-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7260-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41887 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47879 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37476 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41887 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47878 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-41887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41887 · Security Note