PT-2024-20112 · Unknown+3 · Openrefine+3

L0N3Rs · Published 2024-02-12 · Updated 2025-02-10 · CVE-2024-23833

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenRefine versions <= 3.7.7

Description A jdbc attack vulnerability exists in OpenRefine where an attacker may construct a JDBC query to read files on the host filesystem. This issue allows attackers to read sensitive files on the target server, but due to the newer MySQL driver library in the latest version of OpenRefine, original code execution cannot be achieved.

Recommendations For OpenRefine versions <= 3.7.7, upgrade to version 3.7.8 to resolve the issue. As a temporary workaround, consider restricting access to the JDBC connection to minimize the risk of exploitation. Avoid using the allowLoadLocalInfile and allowUrlInLocalInfile parameters in the JDBC connection string until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Path traversal

Weakness Enumeration

CWE-863

CWE-22

Related Identifiers

CVE-2024-23833

GHSA-6P92-QFQF-QWX4

USN-7260-1

Affected Products

Debian

Linuxmint

Openrefine

Ubuntu

References · 26

• 🔥 https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-6p92-qfqf-qwx4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23833.json · Exploit
• https://github.com/OpenRefine/OpenRefine/commit/41ccf574847d856e22488a7c0987ad8efa12a84a · Patch
• https://osv.dev/vulnerability/GHSA-6p92-qfqf-qwx4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23833 · Security Note
• https://osv.dev/vulnerability/USN-7260-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23833 · Security Note
• https://ubuntu.com/security/CVE-2024-47880 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-23833 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23833 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41886 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47882 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23833 · Vendor Advisory