CVE-2024-47879

What it actually does

Missing CSRF protection on the preview-expression endpoint allows an attacker-supplied expression containing arbitrary Clojure or Python code to be executed against a known project that has at least one row.

Why it matters to the business

Attackers can run unauthorized code inside an organization's data-cleaning environment, risking data exposure, tampering, or further compromise of connected systems.

How an attack unfolds

An attacker first identifies a valid project identifier from a target OpenRefine instance, then hosts a malicious webpage containing a crafted form or script that posts an attacker-controlled expression to the preview-expression command; when an authenticated user visits the page the browser submits the request and the expression executes on the server.

How to fix it

Upgrade OpenRefine to version 3.8.3 or later; the fix is included in commit d70d9114a8c021a233f0c13c73a0a7784276f2a4. Apply the corresponding SUSE package updates for aspell where listed in affected products.

How to confirm the fix worked

Confirm the running version is 3.8.3 or newer, verify that preview-expression requests now require a valid CSRF token, and test that cross-origin POSTs without a token are rejected.

Typical attack path

1. Reconnaissance to obtain a valid project ID from a reachable OpenRefine instance
2. Creation of a malicious website that forges a POST to /command/core/preview-expression
3. Social engineering to lure an authenticated user to the malicious site
4. Browser submits the forged request carrying the victim's session
5. Server evaluates the attacker-supplied Clojure or Python expression

How to detect it

Inspect web-server and application logs for POST requests to the preview-expression command originating from external referrers or lacking expected CSRF tokens; correlate with user activity around the time of suspected visits to untrusted sites.

What your security team should do

• Immediately upgrade all OpenRefine deployments to 3.8.3
• Review network logs for unexpected POSTs to preview-expression endpoints
• Educate users about the risk of visiting untrusted sites while logged into internal tools