PT-2024-32871 · Unknown+3 · Openrefine+3

Highwetneb · Published 2024-10-24 · Updated 2025-02-10 · CVE-2024-47880

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.8.3

Description The issue allows an attacker to lead a user to a malicious page that submits a form POST containing embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled Content-Type header, and potentially executed in the victim's browser as if it was part of OpenRefine. The attacker-provided code can perform actions such as deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present. The attacker must know a valid project ID of a project that contains at least one row.

Recommendations For versions prior to 3.8.3, update to version 3.8.3 to fix the issue. As a temporary workaround, consider restricting access to the export-rows command or disabling the feature until a patch is available. Additionally, restricting the Content-Type header override and requiring a CSRF token could help mitigate the issue. It is also recommended to add a Content-Security-Policy header to the response to disable scripts and other potentially executable content.

Exploit

Fix

XSS

Weakness Enumeration

CWE-348

CWE-79

Related Identifiers

CVE-2024-47880

GHSA-79JV-5226-783F

USN-7260-1

Affected Products

Debian

Linuxmint

Openrefine

Ubuntu

References · 24

• 🔥 https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47880.json · Exploit
• https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d · Patch
• https://ubuntu.com/security/CVE-2024-47879 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47880 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7260-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47880 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47880 · Security Note
• https://ubuntu.com/security/CVE-2024-47880 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47880 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41886 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47882 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47880 · Security Note