Publish GHSA-79jv-5226-783f

2026-05-22 18:04:22 -07:00 · 2024-10-24 18:02:04 +00:00
parent 449826ddd3
commit 4e407ee57e
1 changed files with 62 additions and 0 deletions
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-79jv-5226-783f",
+  "modified": "2024-10-24T18:00:06Z",
+  "published": "2024-10-24T18:00:06Z",
+  "aliases": [
+    "CVE-2024-47880"
+  ],
+  "summary": "OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand",
+  "details": "### Summary\n\nThe `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request.\n\nAn attacker could lead a user to a malicious page that submits a form POST that contains  embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled `Content-Type` header, and so potentially executed in the victim's browser as if it was part of OpenRefine.\n\nThe attacker must know a valid project ID of a project that contains at least one row.\n\n### Details\n\nThe malicious form sets `contentType` to `text/html` (ExportRowsCommand.java line 101) and `preview` to `true` (line 107). This combination causes the browser to treat what OpenRefine thinks of as an export preview as a regular webpage.\n\nIt would be safer if the `export-rows` command did not allow overriding the Content-Type header at all, instead relying on the exporter to provide the correct Content-Type. It could also require a CSRF token. As an additional measure, it could add a Content-Security-Policy header to the response disabling scripts and such entirely.\n\nAt least the CSV exporter (`separator` and `lineSeparator` fields) and templating exporter (any field) are affected. It may also be possible to inject into the `dateSettings.custom` field or the SQL exporter default value field, if the project contains date or null cells.\n\n### PoC\n\nAn example form that demonstrates the issue is available on https://wandernauta.nl/os/.\n\n### Impact\n\nExecution of arbitrary JavaScript in the user's browser. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.openrefine:openrefine"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.8.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/OpenRefine/OpenRefine"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-348",
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-24T18:00:06Z",
+    "nvd_published_at": null
+  }
+}