Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Details The database extension, with some restrictions, lets users connect to any database they wish by filling in different parts of the JDBC URL that is used. For the SQLite integration, the extension expects a file path pointing to a database file (or a place where such a file can be created). This means that users can: Read files on local or SMB filesystems, provided they are SQLite databases. Write to files on local or SMB filesystems, as long as those files are either SQLite databases or empty. This seems to be the expected behavior. However, by adding ?enableloadextension=true to the filename, a feature is toggled that additionally allows loading and executing shared libraries mentioned in queries,…
Recommended action: Upgrade to 3.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) Details Vulnerability Recurrence Start by constructing a malicious MySQL Server (using the open source project MySQLFakeServer here). Then go to the Jdbc connection trigger vulnerability Vulnerability Analysis This vulnerability is the bypass of CVE-2023-41887 vulnerability repair, the main vulnerability principle is actually the use of official syntax features, as shown in the following figure, when the connection we can perform parameter configuration in the Host part In com.google.refine.extension.database.mysql.MySQLConnectionManager#getConnection method in the final JdbcUrl structure That is, in the toURI method call here, you can see that the Host part is directly concatenated for any verification, which can be bypassed using the address feature of mysql That is, in the toURI method call here, you can see that the Host part is directly concatenated for any verification, which can be bypassed using the…
Recommended action: Upgrade to 3.7.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An remote Code exec vulnerability allows any unauthenticated user to exec code on the server. Details Hi,Team, i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can get rce on the server through the mysql userializable If the mysql-connector-java version used on the server side is less than 8.20. In order for the server to enable deserialization we need to set the autoDeserialize and queryInterceptors parameters in the connection string,As same with https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m, since the concatenation string is a direct concatenation, it is possible to inject the required parameters after the other parameters. And there is a commons-beanutils dependency library on the server side, which contains an RCE-capable deserialization exploit chain PoC env: centos 7 openrefine 3.7.4 jdk11 mysql-connector-java…
Recommended action: Upgrade to 3.7.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file read vulnerability allows any unauthenticated user to read the file on the server. Details Hi,Team, i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can read the file on the server. There are some differences in utilization depending on the version of the mysql-connector dependency on the server side. 1. mysql-connector-java version 8.14 The default value of allowLoadLocalInfile on the server side is false in this case.We need to manually set this value to true in the connection string. Since the way to get the databaseurl in com/google/refine/extension/database/mysql/MySQLConnectionManager.java is to splice the individual configurations directly, we can set the allowLoadLocalInfile parameter after the other parameters(for example the databaseName parameter ). 2. mysql-connector-java version <= 8.14 The default value of…
Recommended action: Upgrade to 3.7.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.