Summary
It was discovered that OpenRefine did not properly handle opening tar
files. If a user or application were tricked into opening a crafted tar
file, an attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 22.04 LTS. (CVE-2023-37476)
It was discovered that OpenRefine incorrectly handled file permissions and
user authentication. An unauthenticated attacker could possibly use this
issue to leak sensitive information or execute arbitrary code. This issue
only affected Ubuntu 22.04 LTS. (CVE-2023-41886, CVE-2023-41887)
It was discovered that OpenRefine did not properly disallow database
settings to be modified when queried. An attacker could possibly use this
issue to leak sensitive information. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23833)
It was discovered that OpenRefine did not properly sanitize the GET
parameter for authorized commands, leading to a cross site scripting
vulnerability. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-47878)
It was discovered that OpenRefine did not properly prevent cross-site
request forgery when running the preview-expression command. If a user or
application were tricked into opening a specially crafted webpage, an
attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-47879)
It was discovered that OpenRefine did not properly handle HTTP headers.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-47880)
It was discovered that OpenRefine incorrectly handled database extensions.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-47881)
It was discovered that OpenRefine did not properly escape HTML tags in
exception messages, which could enable code injection. If a user or
application were tricked into opening a malicious file, an attacker could
use this issue to execute arbitrary code. (CVE-2024-47882)
It was discovered that OpenRefine did not correctly handle paths when
executing the load-language command. An attacker could possibly use this
issue to leak sensitive information. (CVE-2024-49760)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | openrefine | 3.5.2-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | openrefine | 3.7.7-1ubuntu0.1~esm1 |
Vulnerabilities 10
-
Critical 9.8CVE-2023-41887 EPSS 43%
Remote Code exec in project import with mysql jdbc url attack
OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.
-
High 8.1
Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead o…
-
High 8.1
OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker …
-
High 8.1
OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load …
-
High 7.6
OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression…
-
High 7.5
OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack
OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.
-
High 7.5
OpenRefine JDBC Attack Vulnerability
OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the ne…
-
High 7.1
OpenRefine has a path traversal in LoadLanguageCommand
OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions p…
-
Medium 5.9
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if …
-
Medium 5.5
Zip slip in OpenRefine
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnera…
References
-
report
https://ubuntu.com/security/CVE-2023-37476
-
report
https://ubuntu.com/security/CVE-2023-41886
-
report
https://ubuntu.com/security/CVE-2023-41887
-
report
https://ubuntu.com/security/CVE-2024-23833
-
report
https://ubuntu.com/security/CVE-2024-47878
-
report
https://ubuntu.com/security/CVE-2024-47879
-
report
https://ubuntu.com/security/CVE-2024-47880
-
report
https://ubuntu.com/security/CVE-2024-47881
-
report
https://ubuntu.com/security/CVE-2024-47882
-
report
https://ubuntu.com/security/CVE-2024-49760