CVE-2024-23833
📋 TL;DR
OpenRefine versions up to 3.7.7 contain a JDBC attack vulnerability that allows attackers to read arbitrary files on the host filesystem. This occurs when attackers can construct malicious JDBC queries, potentially exposing sensitive server files. All users running OpenRefine 3.7.7 or earlier are affected.
💻 Affected Systems
- OpenRefine
📦 What is this software?
Openrefine by Openrefine
⚠️ Risk & Real-World Impact
Worst Case
Attackers read sensitive files like configuration files, credentials, SSH keys, or database files, leading to data breach and potential lateral movement.
Likely Case
Unauthorized file read of sensitive server files, potentially exposing credentials or configuration data.
If Mitigated
Limited impact if file permissions restrict access to sensitive files and network access is controlled.
🎯 Exploit Status
Exploitation requires ability to construct JDBC queries, which may be available through various OpenRefine interfaces. No authentication needed for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.8
Vendor Advisory: https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-6p92-qfqf-qwx4
Restart Required: Yes
Instructions:
1. Download OpenRefine 3.7.8 or later from official sources. 2. Stop the OpenRefine service. 3. Replace the installation with the new version. 4. Restart the OpenRefine service.
🔧 Temporary Workarounds
No official workarounds
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict network access to OpenRefine instances using firewall rules to only trusted IPs
- Implement strict file system permissions to limit what files OpenRefine can access
🔍 How to Verify
Check if Vulnerable:
Check OpenRefine version by running the application and viewing the version in the interface or checking the installation directory.Check Version:
Check the version.txt file in OpenRefine installation directory or view version in web interfaceVerify Fix Applied:
Verify installation shows version 3.7.8 or higher in the application interface or version file.📡 Detection & Monitoring
Log Indicators:
- Unusual JDBC connection attempts
- File read operations from unexpected paths
- Error logs containing file path traversal patterns
Network Indicators:
- JDBC connection attempts to OpenRefine from untrusted sources
- Unusual data extraction patterns
SIEM Query:
Search for file access patterns in OpenRefine logs containing '../' or absolute paths🔗 References
- https://github.com/OpenRefine/OpenRefine/commit/41ccf574847d856e22488a7c0987ad8efa12a84a
- https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-6p92-qfqf-qwx4
- https://github.com/OpenRefine/OpenRefine/commit/41ccf574847d856e22488a7c0987ad8efa12a84a
- https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-6p92-qfqf-qwx4
