Skip to content
OpenAdvisories
Medium · 5.9 CVE-2024-47882 EUVD-2024-3067GHSA-j8hp-f2mj-586g

OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

Published Oct 24, 2024 · Updated Oct 25, 2024 · Assigned by GitHub_M

Description

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult. However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.

Affected products

VendorProductAffectedFixed
OpenRefine OpenRefine < 3.8.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 openrefine 3.8.7-1 —
Debian 12 openrefine 3.6.2-2+deb12u3 —
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS openrefine 3.7.7-1ubuntu0.1~esm1 USN-7260-1
Ubuntu Pro 22.04 LTS openrefine 3.5.2-1ubuntu0.1~esm1 USN-7260-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.openrefine:openrefine < 3.8.3 3.8.3 GHSA-j8hp-f2mj-586g

Advisories 1

References