CVE-2023-41886: OpenRefine Arbitrary File Read Vulnerability
Summary
CVE-2023-41886: OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack. Affects org.openrefine:database versions < 3.7.5. Fixed in 3.7.5. How to fix ↓
Also tracked for
- openrefine · Debian:12
The same CVE-2023-41886 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenRefine is an open-source data cleaning and transformation tool that allows users to import, clean, and transform data from various sources. It includes support for importing data from databases using JDBC connections. The OpenRefine database module, specifically the MySQL JDBC connector, is vulnerable to an arbitrary file read attack.
Vulnerability Detail
The vulnerability arises when OpenRefine uses a MySQL JDBC URL to connect to a database. Depending on the version of the mysql-connector-java dependency on the server side, the default value of the allowLoadLocalInfile parameter may vary. If the version is greater than 8.14, the default value is false, requiring the parameter to be manually set to true in the connection string. However, if the version is less than or equal to 8.14, the default value is true, allowing an unauthenticated attacker to read arbitrary files on the server. By exploiting this vulnerability, an attacker can potentially access sensitive files, such as the /etc/passwd file.
How To Fix
Minimum fixed version
3.7.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to manually set the allowLoadLocalInfile parameter to false in the connection string for mysql-connector-java versions greater than 8.14. This can help mitigate the risk of arbitrary file read attacks.
Conclusion
The OpenRefine Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files on the server. It is crucial to upgrade to a fixed version of OpenRefine and mysql-connector-java to mitigate this vulnerability. Additionally, server configurations should be reviewed and secured to prevent unauthorized access to sensitive files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.openrefine:database →
FAQ
OpenRefine is an open-source data cleaning and transformation tool that allows users to import, clean, and transform data from various sources.
A MySQL JDBC URL is a connection string used by OpenRefine to connect to a MySQL database. It contains the necessary information, such as the host, port, and database name, to establish a connection.
The vulnerability allows an unauthenticated attacker to read arbitrary files on the server where OpenRefine is deployed. This can potentially lead to unauthorized access to sensitive information.
The recommended fix is to upgrade to OpenRefine version 3.7.5 or later and ensure that the mysql-connector-java dependency is updated to a version that addresses this issue. Server configurations should also be reviewed and secured to prevent unauthorized access to sensitive files.
Yes, a possible workaround is to manually set the allowLoadLocalInfile parameter to false in the connection string for mysql-connector-java versions greater than 8.14. However, upgrading to a fixed version is still recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.openrefine:database.
