OpenRefine up to 3.8.2 URL authorized state cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in OpenRefine up to 3.8.2. This issue affects some unknown processing of the file /extension/gdata/authorized of the component URL Handler. Such manipulation of the argument state leads to cross site scripting. This vulnerability is referenced as CVE-2024-47878. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenRefine up to 3.8.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extension/gdata/authorized of the component URL Handler. The manipulation of the argument state with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-47878 since 10/04/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability scanner Nessus provides a plugin with the ID 215187 (Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : OpenRefine vulnerabilities (USN-7260-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.8.3 eliminates this vulnerability. Applying the patch 10bf0874d67f1018a58b3732332d76b840192fea is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (215187). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• OpenRefine

Version

• 3.8.0
• 3.8.1
• 3.8.2

License

• open-source

Website

• Product: https://github.com/OpenRefine/OpenRefine/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion