CVE-2024-47882

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult. However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenRefine/OpenRefine/blob/master/main/webapp/modules/core/error.vt#L52-L53	Product
https://github.com/OpenRefine/OpenRefine/commit/85594e75e7b36025f7b6a67dcd3ec253c5dff8c2	Patch
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-j8hp-f2mj-586g	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-24 21:15

Updated : 2024-10-28 14:26

NVD link : CVE-2024-47882

Mitre link : CVE-2024-47882

CVE.ORG link : CVE-2024-47882

JSON object : View

Products Affected

openrefine

openrefine

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-81

Improper Neutralization of Script in an Error Message Web Page

{"id": "CVE-2024-47882", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-10-24T21:15:13.160", "references": [{"url": "https://github.com/OpenRefine/OpenRefine/blob/master/main/webapp/modules/core/error.vt#L52-L53", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenRefine/OpenRefine/commit/85594e75e7b36025f7b6a67dcd3ec253c5dff8c2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-j8hp-f2mj-586g", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-81"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult. However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue."}, {"lang": "es", "value": "OpenRefine es una herramienta gratuita de c\u00f3digo abierto para trabajar con datos desordenados. Antes de la versi\u00f3n 3.8.3, la p\u00e1gina de error integrada \"\u00a1Algo sali\u00f3 mal!\" incluye el mensaje de excepci\u00f3n y el seguimiento de la excepci\u00f3n sin etiquetas HTML de escape, lo que permite la inyecci\u00f3n en la p\u00e1gina si un atacante puede producir de forma fiable un error con un mensaje influenciado por el atacante. Parece que la \u00fanica forma de llegar a este c\u00f3digo en OpenRefine es que un atacante convenza de alg\u00fan modo a una v\u00edctima de que importe un archivo malicioso, lo que puede ser dif\u00edcil. Sin embargo, las extensiones fuera del \u00e1rbol pueden a\u00f1adir sus propias llamadas a `respondWithErrorPage`. La versi\u00f3n 3.8.3 tiene una soluci\u00f3n para este problema."}], "lastModified": "2024-10-28T14:26:11.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B0F993E-8EB2-4CD2-8985-3DCD90F7EBBF", "versionEndExcluding": "3.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}