ExploitCVE-2024-47882
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary
OpenRefine, a free and open-source tool for working with messy data, contains a vulnerability in versions prior to 3.8.3. The built-in "Something went wrong!" error page includes exception messages and tracebacks without properly escaping HTML tags. This enables potential injection into the page if an attacker can reliably produce an error with an attacker-influenced message. The primary attack vector appears to be convincing a victim to import a malicious file, which may be challenging. However, out-of-tree extensions that use 'respondWithErrorPage' may introduce additional attack surfaces.
Impact
The vulnerability allows for the execution of arbitrary JavaScript in the victim's browser, which can lead to a range of impacts. The attacker can potentially perform any action that the user can do within the browser context. This includes accessing and modifying sensitive information, manipulating the browser's DOM, and potentially interacting with other web applications the user has access to. The vulnerability has a high integrity impact and a low confidentiality impact, indicating that while data modification is a significant risk, data exposure is less severe but still possible. The CVSS v3.1 base score is 6.1, indicating a medium severity level. The attack vector is network-based, requires low attack complexity, and no privileges, but does require user interaction. The scope is changed, meaning the vulnerable component impacts resources beyond its security scope.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability was fixed in OpenRefine version 3.8.3, released on October 24, 2024. The patch addresses the HTML escaping issue in the error page.
Mitigation
1. Update OpenRefine to version 3.8.3 or later as soon as possible. 2. Implement strict input validation and output encoding to prevent cross-site scripting attacks. 3. Use Content Security Policy (CSP) headers to restrict the execution of scripts from unauthorized sources. 4. Educate users about the risks of importing untrusted projects or files into OpenRefine. 5. Implement browser security features like X-XSS-Protection headers. 6. Regularly update and patch all associated software and dependencies. 7. Consider implementing additional security measures such as sandboxing for imported projects. 8. If using out-of-tree extensions, review their use of 'respondWithErrorPage' and ensure proper HTML escaping is in place.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Timeline
Feedly found the first article mentioning CVE-2024-47882. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-47882
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.05% (Percentile: 16.6%)
A CVSS base score of 6.1 has been assigned.