CVE-2023-41887: OpenRefine Remote Code Execution in Project Import with MySQL JDBC URL Attack
Summary
CVE-2023-41887: OpenRefine Remote Code execution in project import with mysql jdbc url attack. Affects org.openrefine:database versions < 3.7.5. Fixed in 3.7.5. How to fix ↓
Also tracked for
- openrefine · Debian:12
The same CVE-2023-41887 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenRefine is an open-source data cleaning and transformation tool that allows users to import, clean, and transform data from various sources. It includes support for importing data from databases using JDBC connections. The vulnerability in question arises when using a MySQL JDBC URL that allows for a remote code execution attack.
Vulnerability Detail
The vulnerability allows an unauthenticated attacker to execute arbitrary code on the server. This is possible due to a combination of factors: the use of a vulnerable version of the mysql-connector-java library (version less than 8.20), the ability to enable deserialization through specific parameters in the connection string, and the presence of a commons-beanutils dependency library on the server side that contains an exploit chain capable of remote code execution.
How To Fix
Minimum fixed version
3.7.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround can be implemented by modifying the connection string parameters. Specifically, the autoDeserialize and queryInterceptors parameters should be set to enable deserialization and prevent the attack. For example:
jdbc:mysql://<host>:<port>/<database>?autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor#
Conclusion
The OpenRefine Remote Code Execution vulnerability in project import with MySQL JDBC URL attack allows unauthenticated attackers to execute arbitrary code on the server. It is crucial to upgrade to the latest version of OpenRefine and ensure the mysql-connector-java library is updated to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.openrefine:database →
FAQ
The vulnerability allows an unauthenticated attacker to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
OpenRefine version 3.7.4 and earlier are affected by this vulnerability.
No, the vulnerability can be exploited by an unauthenticated attacker.
Upgrading to OpenRefine version 3.7.5 or later and ensuring the mysql-connector-java library is updated to a version equal to or greater than 8.20 are the recommended mitigations.
Yes, a proof-of-concept exploit has been provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.openrefine:database.
