Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

CVE-2024-47883

What is CVE-2024-47883?

The MIT Simile Butterfly Framework, primarily associated with OpenRefine, is designed for resource management within web applications. However, prior to version 1.2.6, a potential vulnerability exists when the application accepts a 'file:/' URL instead of a relative path. This misconfiguration allows an attacker to manipulate resource access, leading to significant risks such as path traversal, which could permit unauthorized file access on the server, and server-side request forgery, enabling access to files on remote machines. Furthermore, if an attacker can influence the loading of a crafted URL, there is a risk of cross-site scripting, facilitating the execution of malicious JavaScript in victim browsers. Critical to note, an attacker could also exploit the template fetching mechanism, potentially leading to remote code execution. Version 1.2.6 contains a fix to address these vulnerabilities.

References