OpenRefine up to 3.7.3 Malicious path traversal

Summaryinfo

A vulnerability marked as critical has been reported in OpenRefine up to 3.7.3. The impacted element is an unknown function of the component Malicious Handler. The manipulation leads to path traversal. This vulnerability is traded as CVE-2023-37476. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenRefine up to 3.7.3 and classified as critical. This issue affects an unknown code of the component Malicious Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.

The weakness was shared 07/18/2023 as GHSA-m88m-crr9-jvqq. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-37476 since 07/06/2023. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 215187 (Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : OpenRefine vulnerabilities (USN-7260-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.7.4 eliminates this vulnerability. Applying the patch e9c1e65d58b47aec8cd676bd5c07d97b002f205e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (215187). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• OpenRefine

Version

• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3

License

• open-source

Website

• Product: https://github.com/OpenRefine/OpenRefine/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion