PT-2024-8658 · Unknown+3 · Openrefine+3

Highwetneb · Published 2024-10-24 · Updated 2025-02-10 · CVE-2024-47881

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenRefine versions 3.4-beta through 3.8.2

Description The issue is related to the database extension in OpenRefine, where the "enable load extension" property can be set for the SQLite integration. This allows an attacker to load and execute arbitrary code on the server by loading local or remote extension DLLs. The attacker needs to have network access to the OpenRefine instance. The vulnerability can be exploited to achieve remote code execution.

Recommendations For OpenRefine versions 3.4-beta through 3.8.2, update to version 3.8.3 to fix the issue. As a temporary workaround, consider setting enable load extension to false or restricting access to the database extension to minimize the risk of exploitation. Additionally, consider implementing mitigation steps such as having users upload the SQLite database file, making the path relative to the workspace directory, adding additional checks to the path, using the READONLY open mode, and enforcing stricter limits.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-10250

CVE-2024-47881

GHSA-87CF-J763-VVH8

USN-7260-1

Affected Products

Debian

Linuxmint

Openrefine

Ubuntu

References · 27

• 🔥 https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-87cf-j763-vvh8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47881.json · Exploit
• https://github.com/OpenRefine/OpenRefine/commit/853a1d91662e7dc278a9a94a38be58de04494056 · Patch
• https://ubuntu.com/security/CVE-2024-47879 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7260-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47881 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47881 · Security Note
• https://ubuntu.com/security/CVE-2024-47880 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47881 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41886 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47882 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87cf-j763-vvh8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10250 · Security Note