CVE-2024-47878

What it actually does

Reflected XSS via unsanitized state GET parameter echoed verbatim inside a script tag at the /extension/gdata/authorized endpoint, allowing arbitrary JavaScript execution in the victim's browser context.

Why it matters to the business

Attackers can hijack user sessions, exfiltrate or alter sensitive data being processed in the tool, or perform unauthorized actions on behalf of the victim, leading to data integrity issues and potential compliance violations in data-heavy workflows.

How an attack unfolds

An attacker crafts a malicious URL containing JavaScript in the state parameter, then delivers it to a victim via phishing or another redirect; when the victim visits the link, the browser executes the injected code as part of the OpenRefine page.

How to fix it

Upgrade OpenRefine to version 3.8.3 or later, which sanitizes the state parameter before rendering; apply the fix from commit d70d9114a8c021a233f0c13c73a0a7784276f2a4 if building from source.

How to confirm the fix worked

Confirm the deployed version is 3.8.3 or newer; test the endpoint by supplying a benign script in the state parameter and verify it is no longer executed; review change logs or source for escaping logic on the state value.

Typical attack path

1. Attacker identifies the vulnerable /extension/gdata/authorized endpoint
2. Attacker embeds malicious JavaScript payload in the state query parameter
3. Attacker delivers the crafted URL to a target user through phishing or social engineering
4. Victim authenticates or interacts with the link, triggering script execution in their browser
5. Executed script performs actions such as session theft, data exfiltration, or unauthorized operations within OpenRefine

How to detect it

Review web server and application logs for requests to /extension/gdata/authorized containing suspicious state parameters with script tags, event handlers, or encoded JavaScript; check browser console logs or proxy captures for unexpected script execution originating from that endpoint.

• /extension/gdata/authorized?state=
• state parameter containing <script
• state parameter containing javascript:
• unexpected eval or document.write calls after visiting gdata endpoint

What your security team should do

• Immediately upgrade all OpenRefine instances to 3.8.3
• Restrict external access to the gdata extension endpoints until patched
• Monitor for unusual script execution or unexpected redirects in user sessions
• Educate users on verifying URLs before interacting with data tool links