From fdf6877d3c6aa49e9dae1e99e2efdf03b6fb52d4 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 24 Oct 2024 18:29:16 +0000
Subject: [PATCH] Publish GHSA-mpcw-3j5p-p99x

---
 .../GHSA-mpcw-3j5p-p99x.json                  | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/10/GHSA-mpcw-3j5p-p99x/GHSA-mpcw-3j5p-p99x.json

diff --git a/advisories/github-reviewed/2024/10/GHSA-mpcw-3j5p-p99x/GHSA-mpcw-3j5p-p99x.json b/advisories/github-reviewed/2024/10/GHSA-mpcw-3j5p-p99x/GHSA-mpcw-3j5p-p99x.json
new file mode 100644
index 00000000000..938179d313b
--- /dev/null
+++ b/advisories/github-reviewed/2024/10/GHSA-mpcw-3j5p-p99x/GHSA-mpcw-3j5p-p99x.json
@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mpcw-3j5p-p99x",
+  "modified": "2024-10-24T18:27:50Z",
+  "published": "2024-10-24T18:27:50Z",
+  "aliases": [
+
+  ],
+  "summary": "Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)",
+  "details": "### Summary\n\nUsage of the `Butterfly.prototype.parseJSON` or `getJSON` functions on an attacker-controlled crafted input string allows the attacker to execute arbitrary JavaScript code on the server.\n\nSince Butterfly JavaScript code has access to Java classes, it can run arbitrary programs.\n\n### Details\n\nThe `parseJSON` function (edu/mit/simile/butterfly/Butterfly.js:64) works by calling `eval`, an approach that goes back to the original library by Crockford, before JSON was part of the ECMAScript language. It uses a regular expression to remove strings from the input, then checks that there are no unexpected characters in the non-string remainder.\n\nHowever, the regex is imperfect, as was [discovered earlier by Mike Samuel](https://dev.to/mikesamuel/2008-silently-securing-jsonparse-5cbb); specifically, the \"cleaner\" can be tricked into treating part of the input as a string that the \"evaluator\" does not, because of a difference in interpretation regarding the [the Unicode zero-width joiner character](https://unicode-explorer.com/c/200D). Representing that character with a visible symbol, a malicious input looks like:\n\n```js\n\"\\�\\\", Packages.java.lang.Runtime.getRuntime().exec('gnome-calculator')) // \"\n```\n\nThis is understood...\n\n* by `JSON_cleaning_RE` as a single string, and because it is a string it can be collapsed to nothing, which is not problematic, so the original input proceeds to `eval`.\n* by the `eval` function, which ignores zero-width joiners entirely, as a string containing a single escaped backslash, followed by a comma, then a function call, closing parenthesis, and finally a line comment.\n \nThe function call is evaluated, and a calculator is opened.\n\nPossible mitigations and additional defenses could include:\n\n* Replacing the JSON implementation with Rhino's built-in implementation.\n* Dropping all JSON-related and JSONP-related code entirely.\n* Restricting the access the JavaScript controller code has to the rest of the system by using `initSafeStandardObjects` instead of `initStandardObjects`, using `setClassShutter`, and so on.\n\n### PoC\n\nChange OpenRefine `core` `controller.js` to add a call to the vulnerable `getJSON` function:\n\n```diff\ndiff --git a/main/webapp/modules/core/MOD-INF/controller.js b/main/webapp/modules/core/MOD-INF/controller.js\nindex 4ceba0676..1ce0936d2 100644\n--- a/main/webapp/modules/core/MOD-INF/controller.js\n+++ b/main/webapp/modules/core/MOD-INF/controller.js\n@@ -631,0 +632,5 @@ function process(path, request, response) {\n+    if (path == \"getjsontest\") {\n+      butterfly.getJSON(request);\n+      return true;\n+    }\n+\n```\n\nThen, restart OpenRefine and submit the malicious request. For example, the following `bash` command (with $' quoting) should do it:\n\n```\ncurl -H 'Content-Type: application/json;charset=utf-8' --data $'\"\\\\\\u200d\\\\\", Packages.java.lang.Runtime.getRuntime().exec(\\'gnome-calculator\\')) // \"' http://localhost:3333/getjsontest\n```\n\n### Impact\n\nAny JavaScript controller that calls one of these functions is vulnerable to remote code execution.\n\nOpenRefine itself seems unaffected; both OpenRefine and jQuery have their own functions also called parseJSON and getJSON, but those are unrelated.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.openrefine.dependencies:butterfly"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.2.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/simile-butterfly/security/advisories/GHSA-mpcw-3j5p-p99x"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/simile-butterfly/commit/2ad1fa4cd8afe3c920c8e6e04fe7a7df5cf8294e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/OpenRefine/simile-butterfly"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-185",
+      "CWE-95"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-24T18:27:50Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file