OpenRefine RCE via malicious .tar import 3.7.3
CVE-2023-37476 Published on July 17, 2023

Zip slip in OpenRefine
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.

Github Repository NVD

Vulnerability Analysis

CVE-2023-37476 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
LOW

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2023-37476 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2023-37476

stack.watch emails you whenever new vulnerabilities are published in Openrefine or Canonical Ubuntu Linux. Just hit a watch button to start following.

Openrefine
 
Canonical Ubuntu Linux
 

Affected Versions

OpenRefine Version < 3.7.4 is affected by CVE-2023-37476

Vulnerable Packages

The following package name and versions may be associated with CVE-2023-37476

Package Manager Vulnerable Package Versions Fixed In
maven org.openrefine:main < 3.7.4 3.7.4

Exploit Probability

EPSS
0.21%
Percentile
43.16%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.