CVE-2024-49760
📋 TL;DR
OpenRefine versions before 3.8.3 contain a path traversal vulnerability in the load-language command that allows attackers to read arbitrary JSON files on the file system. This affects all users running vulnerable versions of OpenRefine, particularly those with internet-facing instances or untrusted user access.
💻 Affected Systems
- OpenRefine
📦 What is this software?
Openrefine by Openrefine
⚠️ Risk & Real-World Impact
Worst Case
Sensitive configuration files, credentials, or other JSON-formatted data could be exfiltrated from the server, potentially leading to full system compromise.
Likely Case
Attackers can read application configuration files, localization files, or other JSON data stored in accessible directories.
If Mitigated
With proper network segmentation and access controls, impact is limited to reading non-sensitive JSON files within the application directory.
🎯 Exploit Status
The vulnerability is straightforward to exploit by manipulating the lang parameter with directory traversal sequences like ../../etc/passwd
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8.3
Vendor Advisory: https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qfwq-6jh6-8xx4
Restart Required: Yes
Instructions:
1. Download OpenRefine 3.8.3 or later from the official repository. 2. Stop the OpenRefine service. 3. Replace the existing installation with the new version. 4. Restart the OpenRefine service.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to OpenRefine instances to trusted users only
Disable Load-Language Endpoint
allIf language loading functionality is not needed, disable or block access to the vulnerable endpoint
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach OpenRefine instances
- Run OpenRefine with minimal file system permissions and in a chroot/jail environment
🔍 How to Verify
Check if Vulnerable:
Check OpenRefine version. If version is less than 3.8.3, the system is vulnerable.Check Version:
Check the OpenRefine web interface or startup logs for version informationVerify Fix Applied:
Verify that OpenRefine version is 3.8.3 or higher and test that path traversal attempts on the load-language endpoint are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to load-language endpoint with suspicious parameters containing ../ sequences
- Failed attempts to access files outside expected directories
Network Indicators:
- HTTP requests to /command/core/load-language with lang parameter containing path traversal sequences
SIEM Query:
web.url:*load-language* AND (web.param.lang:*../* OR web.param.lang:*..\*)