PT-2024-32872 · Unknown+3 · Openrefine+3
Wetneb
·
Published
2024-10-24
·
Updated
2025-02-10
·
CVE-2024-47882
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenRefine versions prior to 3.8.3
Description
The built-in error page in OpenRefine includes the exception message and exception traceback without escaping HTML tags, allowing injection into the page if an attacker can produce an error with an attacker-influenced message. This can be achieved if an attacker convinces a victim to import a malicious file. Out-of-tree extensions may also add their own calls to
respondWithErrorPage, potentially increasing the risk. The issue enables execution of arbitrary JavaScript in the victim's browser if the victim imports a malicious project.Recommendations
For OpenRefine versions prior to 3.8.3, update to version 3.8.3 to resolve the issue. As a temporary workaround, consider restricting the import of projects from untrusted sources to minimize the risk of exploitation. Additionally, out-of-tree extensions should be reviewed for calls to
respondWithErrorPage and updated accordingly to prevent potential injection attacks.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Openrefine
Ubuntu