CVE-2024-47879: CSRF in OpenRefine allows Expression Execution

The impact of this vulnerability is significant due to the ability to execute arbitrary code. An attacker could craft a malicious website that, when visited by an authenticated OpenRefine user, would silently execute attacker-controlled code. This code could potentially be used to modify data within the OpenRefine project, exfiltrate sensitive information, or even gain further access to the underlying system, depending on the permissions of the OpenRefine user and the server environment. The requirement for a valid project ID limits the scope somewhat, but the potential for data manipulation and code execution remains a serious concern.

1. Reserved2024-10-04
2. Published2024-10-24
3. Modified2024-12-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-47879 is to upgrade OpenRefine to version 3.8.3 or later, which includes the necessary CSRF protection. If upgrading immediately is not possible, consider implementing a Content Security Policy (CSP) to restrict the execution of inline scripts and other potentially malicious content. While not a complete solution, this can reduce the attack surface. Additionally, educate users about the risks of visiting untrusted websites and opening suspicious links. After upgrading, confirm the fix by attempting to trigger the preview-expression command via a crafted HTTP request and verifying that it is properly protected against CSRF.