CVE-2024-47883: RCE in OpenRefine Butterfly Framework

This vulnerability allows an attacker with network access to OpenRefine instances running vulnerable versions to execute arbitrary code. By crafting malicious file:/ URLs, an attacker can trick the application into fetching and executing remote files as if they were trusted components. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The impact is particularly severe because OpenRefine is often used to process sensitive data, making it a valuable target for attackers. The ability to execute arbitrary code effectively grants the attacker full control over the affected system.

1. Reserved2024-10-04
2. Published2024-10-24
3. Modified2024-10-29
4. EPSS updated2026-04-02

The primary mitigation is to upgrade OpenRefine to version 1.2.6 or later, which addresses the vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious file:/ URLs. Carefully review and restrict file access permissions within the OpenRefine environment. Monitor network traffic for unusual connections originating from the OpenRefine server. After upgrading, confirm the fix by attempting to access a known malicious file via a file:/ URL; the request should be rejected.