CVE-2024-47881: OpenRefine Database Extension Allows Remote Code Execution via SQLite Integration
Summary
CVE-2024-47881: OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE). Affects org.openrefine:database versions >= 3.4-beta, < 3.8.3. Fixed in 3.8.3. How to fix ↓
Also tracked for
- openrefine · Debian:12
The same CVE-2024-47881 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenRefine is a powerful open-source tool for working with messy data. It allows users to clean, transform, and analyze data sets efficiently. The database extension enables users to connect to various databases, including SQLite, which is a lightweight database engine. However, this integration has a significant vulnerability that can be exploited if the 'enable_load_extension' property is set, allowing unauthorized access to the filesystem and execution of arbitrary code.
Vulnerability Detail
The vulnerability arises from the database extension of OpenRefine, which allows users to connect to SQLite databases using file paths. By appending '?enable_load_extension=true' to the file path, an attacker can exploit this feature to load and execute shared libraries, leading to remote code execution (RCE). This vulnerability requires network access to the OpenRefine instance, making it a critical security risk for installations exposed to untrusted networks. The potential impact includes unauthorized access to the server and execution of malicious code.
How To Fix
Minimum fixed version
3.8.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing the following workarounds:
- Require users to upload SQLite database files instead of allowing direct file path input.
- Ensure that the file paths are relative to a designated workspace directory and do not escape it.
- Always open SQLite databases in READONLY mode.
- Explicitly set 'enable_load_extension' to off in your configurations.
Conclusion
The vulnerability CVE-2024-47881 in OpenRefine's database extension poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to version 3.8.3 or later to mitigate this risk. Implementing the suggested workarounds can provide temporary relief until an update can be performed.
See every vulnerability recorded for org.openrefine:database →
FAQ
CVE-2024-47881 is a vulnerability in the OpenRefine database extension that allows remote code execution through improper handling of SQLite database connections.
If you are using a version of OpenRefine prior to 3.8.3 and have the database extension enabled, your instance may be vulnerable. You can check your version in the application settings.
The primary risk is remote code execution, which can allow attackers to run arbitrary code on the server, potentially leading to data breaches or server compromise.
Implement workarounds such as restricting file path inputs, using READONLY mode, and disabling the 'enable_load_extension' feature until you can update.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application against known vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.openrefine:database.
