PT-2024-40052 · Unknown · Openrefine
Published
2024-10-24
·
Updated
2024-10-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
OpenRefine version 3.8.2
Description
The issue concerns the exposure of Google API authentication keys, specifically the
client id and client secret, within OpenRefine releases. These keys can be extracted from released artifacts, such as the openrefine-gdata.jar file in the openrefine-3.8.2/webapp/extensions/gdata/module/MOD-INF/lib directory. The keys are encoded in Base64 in the GoogleAPIExtension.java file and can be decoded to obtain the credentials. These credentials can be used by other applications to request access to Google accounts, pretending to be OpenRefine, although this would also require access to user access tokens, which this issue does not expose by itself.Recommendations
For OpenRefine version 3.8.2, the bundled credentials should be revoked.
As a temporary workaround, users should revoke access to their Google account if they have connected it to OpenRefine.
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openrefine