CVE-2024-47879: OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

October 24, 2024 (updated December 4, 2024)

Lack of CSRF protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code.

The attacker must know a valid project ID of a project that contains at least one row.

References

github.com/OpenRefine/OpenRefine
github.com/OpenRefine/OpenRefine/commit/090924ca923489b6c94397cf1f5df7f7f78f0126
github.com/OpenRefine/OpenRefine/security/advisories/GHSA-3jm4-c6qf-jrh3
github.com/advisories/GHSA-3jm4-c6qf-jrh3
nvd.nist.gov/vuln/detail/CVE-2024-47879

Code Behaviors & Features

Detect and mitigate CVE-2024-47879 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →