OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

The impact of this vulnerability is significant due to the ability to execute arbitrary code. An attacker could craft a malicious website that, when visited by an authenticated OpenRefine user, would silently execute attacker-controlled code. This code could potentially be used to modify data within the OpenRefine project, exfiltrate sensitive information, or even gain further access to the underlying system, depending on the permissions of the OpenRefine user and the server environment. The requirement for a valid project ID limits the scope somewhat, but the potential for data manipulation and code execution remains a serious concern.

Organizations and individuals using OpenRefine for data cleaning and transformation are at risk, particularly those who share OpenRefine projects or data with external collaborators. Shared hosting environments where multiple users share the same OpenRefine instance are also at increased risk, as an attacker could potentially compromise the data of other users.

• java / server: Monitor OpenRefine logs for unusual activity related to the preview-expression command. Look for POST requests to the command endpoint without proper CSRF tokens.

 grep "preview-expression" /var/log/openrefine/openrefine.log

• generic web: Use curl to test the preview-expression endpoint with a crafted CSRF request to verify the lack of protection.

curl -X POST -d 'expression=alert("CSRF")' http://localhost:8080/openrefine/projects/<project_id>/data/preview-expression

1. 2024-10-24Disclosure

   disclosure

1. Reserviert2024-10-04
2. Veröffentlicht2024-10-24
3. Geändert2024-12-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-47879 is to upgrade OpenRefine to version 3.8.3 or later, which includes the necessary CSRF protection. If upgrading immediately is not possible, consider implementing a Content Security Policy (CSP) to restrict the execution of inline scripts and other potentially malicious content. While not a complete solution, this can reduce the attack surface. Additionally, educate users about the risks of visiting untrusted websites and opening suspicious links. After upgrading, confirm the fix by attempting to trigger the preview-expression command via a crafted HTTP request and verifying that it is properly protected against CSRF.