{"id":"GHSA-79jv-5226-783f","summary":"OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand","details":"### Summary\n\nThe `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request.\n\nAn attacker could lead a user to a malicious page that submits a form POST that contains  embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled `Content-Type` header, and so potentially executed in the victim's browser as if it was part of OpenRefine.\n\nThe attacker must know a valid project ID of a project that contains at least one row.\n\n### Details\n\nThe malicious form sets `contentType` to `text/html` (ExportRowsCommand.java line 101) and `preview` to `true` (line 107). This combination causes the browser to treat what OpenRefine thinks of as an export preview as a regular webpage.\n\nIt would be safer if the `export-rows` command did not allow overriding the Content-Type header at all, instead relying on the exporter to provide the correct Content-Type. It could also require a CSRF token. As an additional measure, it could add a Content-Security-Policy header to the response disabling scripts and such entirely.\n\nAt least the CSV exporter (`separator` and `lineSeparator` fields) and templating exporter (any field) are affected. It may also be possible to inject into the `dateSettings.custom` field or the SQL exporter default value field, if the project contains date or null cells.\n\n### PoC\n\nAn example form that demonstrates the issue is available on https://wandernauta.nl/os/.\n\n### Impact\n\nExecution of arbitrary JavaScript in the user's browser. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present.","aliases":["CVE-2024-47880"],"modified":"2024-10-30T19:22:57.650164Z","published":"2024-10-24T18:00:06Z","database_specific":{"github_reviewed_at":"2024-10-24T18:00:06Z","nvd_published_at":"2024-10-24T21:15:12Z","cwe_ids":["CWE-348","CWE-79"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47880"},{"type":"WEB","url":"https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d"},{"type":"PACKAGE","url":"https://github.com/OpenRefine/OpenRefine"}],"affected":[{"package":{"name":"org.openrefine:openrefine","ecosystem":"Maven","purl":"pkg:maven/org.openrefine/openrefine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}],"versions":["3.6-beta1","3.6-beta2","3.6-rc1","3.6.0","3.6.1","3.6.2","3.7-beta1","3.7-beta2","3.7.0","3.7.2","3.8-beta1","3.8-beta5","3.8.0","3.8.1","3.8.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-79jv-5226-783f/GHSA-79jv-5226-783f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}