CVE-2024-47881

What it actually does

The database extension allows the enable_load_extension SQLite property to be configured, permitting an attacker to load local or remote extension DLLs and execute arbitrary code on the server.

Why it matters to the business

Successful exploitation grants remote attackers the ability to run arbitrary code on OpenRefine servers, potentially leading to data theft, system compromise, or further network pivoting; the issue affects publicly reachable instances and requires prompt patching despite low observed exploitation rates.

How an attack unfolds

An attacker with network access to an OpenRefine instance configures the enable_load_extension property in the database extension to point at a malicious SQLite extension DLL (local or remote), causing the server to load and execute attacker-controlled code.

How to fix it

Upgrade OpenRefine to version 3.8.3 or later; the fix is present in commit d70d9114a8c021a233f0c13c73a0a7784276f2a4. Disable or restrict the database extension if immediate upgrade is not feasible.

How to confirm the fix worked

Confirm the installed version is 3.8.3 or newer; review database extension configuration to ensure enable_load_extension is not enabled; test connectivity and extension loading behavior in a controlled environment.

Typical attack path

1. Identify publicly reachable OpenRefine instance
2. Access the database extension configuration interface
3. Set enable_load_extension to reference a malicious DLL
4. Trigger SQLite integration to load the extension
5. Execute arbitrary code on the server

How to detect it

Review application logs and configuration files for references to enable_load_extension or unexpected SQLite extension loading; examine process execution and network connections for anomalous DLL loads originating from the database extension.

What your security team should do

• Immediately upgrade all OpenRefine deployments to 3.8.3
• Restrict network access to OpenRefine instances to trusted sources only
• Audit existing configurations for any use of enable_load_extension
• Monitor for new EPSS increases or public exploit releases