Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

This vulnerability allows an attacker with network access to OpenRefine instances running vulnerable versions to execute arbitrary code. By crafting malicious file:/ URLs, an attacker can trick the application into fetching and executing remote files as if they were trusted components. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The impact is particularly severe because OpenRefine is often used to process sensitive data, making it a valuable target for attackers. The ability to execute arbitrary code effectively grants the attacker full control over the affected system.

Organizations using OpenRefine for data cleaning and transformation, particularly those processing sensitive data, are at significant risk. Shared hosting environments where OpenRefine is deployed alongside other applications are also vulnerable, as a compromise of OpenRefine could potentially impact other hosted services. Users relying on older, unpatched OpenRefine installations are especially susceptible.

• java / server:

find /opt/openrefine -type f -name '*.jar' -print0 | xargs -0 grep -i 'butterfly/URLHandler'

• generic web:

curl -I 'http://your-openrefine-server/butterfly/URLHandler?file:/path/to/malicious/file' -w '%{http_code}
'

• generic web:

 grep -i 'file:' /var/log/apache2/access.log

1. 2024-10-24Disclosure

   disclosure

1. Gereserveerd2024-10-04
2. Gepubliceerd2024-10-24
3. Gewijzigd2024-10-29
4. EPSS bijgewerkt2026-04-02

The primary mitigation is to upgrade OpenRefine to version 1.2.6 or later, which addresses the vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious file:/ URLs. Carefully review and restrict file access permissions within the OpenRefine environment. Monitor network traffic for unusual connections originating from the OpenRefine server. After upgrading, confirm the fix by attempting to access a known malicious file via a file:/ URL; the request should be rejected.