CVE-2024-47880

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled `Content-Type` header, and so potentially executed in the victim's browser as if it was part of OpenRefine. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present. The attacker must know a valid project ID of a project that contains at least one row. Version 3.8.3 fixes the issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d	Patch
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-24 21:15

Updated : 2024-10-30 17:42

NVD link : CVE-2024-47880

Mitre link : CVE-2024-47880

CVE.ORG link : CVE-2024-47880

JSON object : View

Products Affected

openrefine

openrefine

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-348

Use of Less Trusted Source

{"id": "CVE-2024-47880", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.6}]}, "published": "2024-10-24T21:15:12.750", "references": [{"url": "https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-348"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled `Content-Type` header, and so potentially executed in the victim's browser as if it was part of OpenRefine. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present. The attacker must know a valid project ID of a project that contains at least one row. Version 3.8.3 fixes the issue."}, {"lang": "es", "value": "OpenRefine es una herramienta gratuita de c\u00f3digo abierto para trabajar con datos desordenados. Antes de la versi\u00f3n 3.8.3, el comando `export-rows` se puede utilizar de forma que refleje parte de la solicitud textualmente, con un encabezado Content-Type tambi\u00e9n tomado de la solicitud. Un atacante podr\u00eda llevar a un usuario a una p\u00e1gina maliciosa que env\u00ede un POST de formulario que contenga c\u00f3digo JavaScript incrustado. Este c\u00f3digo se incluir\u00eda entonces en la respuesta, junto con un encabezado `Content-Type` controlado por el atacante, y por lo tanto potencialmente se ejecutar\u00eda en el navegador de la v\u00edctima como si fuera parte de OpenRefine. El c\u00f3digo proporcionado por el atacante puede hacer todo lo que el usuario puede hacer, incluyendo eliminar proyectos, recuperar contrase\u00f1as de bases de datos o ejecutar expresiones Jython o Closure arbitrarias, si esas extensiones tambi\u00e9n est\u00e1n presentes. El atacante debe conocer un ID de proyecto v\u00e1lido de un proyecto que contenga al menos una fila. La versi\u00f3n 3.8.3 corrige el problema."}], "lastModified": "2024-10-30T17:42:42.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B0F993E-8EB2-4CD2-8985-3DCD90F7EBBF", "versionEndExcluding": "3.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}