Cross-site Request Forgery (CSRF) Affecting org.openrefine:main package, versions [,3.8.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGOPENREFINE-8303777
- published 25 Oct 2024
- disclosed 24 Oct 2024
- credit Unknown
Introduced: 24 Oct 2024
CVE-2024-47879 Open this link in a new tabHow to fix?
Upgrade org.openrefine:main to version 3.8.3 or higher.
Overview
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the PreviewExpressionCommand process due to missing validation of the CSRF token. An attacker can exploit this vulnerability by convincing a user to visit a malicious website and interact with a crafted page that submits a POST request without the user's consent.
Note: This is only exploitable if the attacker knows a valid project ID and the project contains at least one row.
PoC
curl -d project=123456789 -d cellIndex=1 -d rowIndices='[0]' -d 'expression=clojure:(.exec (Runtime/getRuntime) "gnome-calculator")' http://localhost:3333/command/core/preview-expression/