PT-2024-32868 · Unknown+3 · Openrefine+3

Highwetneb · Published 2024-10-24 · Updated 2025-02-10 · CVE-2024-47878

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.8.3

Description The issue concerns the /extension/gdata/authorized endpoint, which includes the state GET parameter verbatim in a <script> tag in the output without escaping. This allows an attacker to lead or redirect a user to a crafted URL containing JavaScript code, which would then be executed in the victim's browser as if it was part of OpenRefine. The state parameter is read from the controller.js file and used in the authorized.vt file without any format checks or verification that the page was opened as part of the authorization flow. This can lead to the execution of arbitrary JavaScript in the user's browser, potentially allowing the attacker-provided code to perform actions such as deleting projects, retrieving database passwords, or executing arbitrary expressions.

Recommendations For versions prior to 3.8.3, update to version 3.8.3 to fix the issue. As a temporary workaround, consider restricting access to the /extension/gdata/authorized endpoint until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47878

GHSA-PW3X-C5VP-MFC3

USN-7260-1

Affected Products

Debian

Linuxmint

Openrefine

Ubuntu

References · 24

• 🔥 https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-pw3x-c5vp-mfc3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47878.json · Exploit
• https://github.com/OpenRefine/OpenRefine/commit/10bf0874d67f1018a58b3732332d76b840192fea · Patch
• https://ubuntu.com/security/CVE-2024-47879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47878 · Security Note
• https://osv.dev/vulnerability/USN-7260-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47878 · Security Note
• https://ubuntu.com/security/CVE-2024-47880 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47878 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41886 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47878 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47882 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47878 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23833 · Vendor Advisory