OpenRefine Vulnerability: HTML Injection via Error Page Exposure
Summary
DEBIAN-CVE-2024-47882: OpenRefine is a free, open source tool for working with messy data. Affects openrefine versions < 3.8.7-1. Fixed in 3.8.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenRefine is a free, open-source tool designed for working with messy data, allowing users to clean, transform, and analyze datasets. It is widely used for data wrangling tasks due to its powerful features and user-friendly interface. However, prior to version 3.8.3, OpenRefine had a vulnerability that exposed sensitive error messages through its built-in error page, potentially allowing for HTML injection attacks.
Vulnerability Detail
The vulnerability arises from the built-in error page in OpenRefine, which displays exception messages and tracebacks without properly escaping HTML tags. This flaw could enable an attacker to inject malicious HTML content into the error page if they can trigger an error with a crafted message. While it may be challenging for an attacker to exploit this directly, the risk increases with the use of out-of-tree extensions that may call the error response function.
How To Fix
Minimum fixed version
3.8.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openrefineTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid importing untrusted files that may trigger the error page, thereby minimizing the risk of exploitation until the package is updated.
Conclusion
The vulnerability in OpenRefine prior to version 3.8.3 poses a risk of HTML injection through its error page. Users are advised to update to version 3.8.7-1 or later to mitigate this risk. Additionally, employing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for openrefine →
FAQ
The vulnerability allows for HTML injection through the error page, exposing sensitive information if an attacker can trigger an error.
Check your OpenRefine version by navigating to the 'About' section in the application. If it is below 3.8.7-1, it is vulnerable.
Avoid importing files from untrusted sources and monitor for updates until you can apply the patch.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using just a manifest file. Visit https://vulert.com for more information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for openrefine.
