High, CVSS 8.6MavenPublished
OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
CVE-2024-47878 · GHSA-pw3x-c5vp-mfc3
- Affected
- Maven org.openrefine:extensions < 3.8.3
- Fixed in
- 3.8.3· Vendor fix available
- Issue
- The /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a <script tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Details The state GET parameter is read from: extensions/gdata/module/MOD-INF/controller.js:105 It is used (as $state) in: extensions/gdata/module/authorized.vt:43 There is no check that the state has the expected format (base64-encoded JSON with values like "openrefine123..." and "cb123..."), or that the page was indeed opened as part of the authorization flow. PoC Navigate to: http://localhost:3333/extension/gdata/authorized?state=%22,alert(1),%22&error= An alert box pops up. The gdata extension needs to be present. No other configuration is needed; specifically, it is not required to have a client ID or client secret set. Impact Execution of arbitrary…
Recommended action: Upgrade to 3.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.