Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47880
Summary
OpenRefine is a free, open source tool for working with messy data. The "export-rows" command can be used in such a way that it reflects part of the request verbatim, with a "Content-Type" header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled "Content-Type" header, and so potentially executed in the victim's browser as if it was part of OpenRefine. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present. The attacker must know a valid project ID of a project that contains at least one row. This issue affects org.openrefine:main versions prior to 3.8.3.
- HIGH
- NETWORK
- LOW
- CHANGED
- REQUIRED
- NONE
- HIGH
- NONE
CWE-79 - Cross Site Scripting
Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.
Advisory Timeline
- Published
