OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
CVE-2024-47881

8.8HIGH

Key Information:

Vendor

Openrefine

Status
Openrefine
Vendor
CVE Published:
24 October 2024

What is CVE-2024-47881?

OpenRefine, a widely-used open-source tool for cleaning and transforming messy data, has a vulnerability within its SQLite integration. This issue allows an attacker with network access to an OpenRefine instance to leverage the 'enable_load_extension' property in the database extension. By doing so, the attacker can load extension DLLs, either from a local or remote source, facilitating the execution of arbitrary code on the server. This vulnerability affects all versions from 3.4-beta up to and including 3.8.2. The issue has been addressed in version 3.8.3, which mitigates the risk of exploitation.

Affected Version(s)

OpenRefine >= 3.4-beta, < 3.8.3

References

https://github.com/OpenRefine/OpenRefine/security/advisor...
x_refsource_CONFIRM
https://github.com/OpenRefine/OpenRefine/commit/853a1d916...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.