CVE-2024-47882

What it actually does

Unescaped exception messages and tracebacks rendered in the built-in error page allow HTML/JS injection when an attacker-controlled message reaches respondWithErrorPage.

Why it matters to the business

Attackers who can trick users into importing malicious files may execute scripts in the victim's browser, risking data exposure or account compromise during sensitive data-cleaning workflows; prevalence in data pipelines increases exposure surface for organizations handling untrusted datasets.

How an attack unfolds

An attacker crafts a file that triggers an error whose message contains executable HTML/JS, convinces a victim to import it into OpenRefine, and the unescaped content executes when the error page renders; out-of-tree extensions that call the same error handler widen the reachable surface.

How to fix it

Upgrade OpenRefine to version 3.8.3 or apply commit d70d9114a8c021a233f0c13c73a0a7784276f2a4; SUSE users of java-1_8_0-openjdk on affected SLES releases should install 1.8.0.302-27.63.2 or later.

How to confirm the fix worked

Confirm installed version is 3.8.3 or newer; attempt to trigger an error with HTML tags in the message and verify tags are escaped in the response page source.

Typical attack path

1. Craft malicious import file containing payload in error-triggering structure
2. Deliver file to victim via email, shared storage, or web link
3. Victim opens file in vulnerable OpenRefine instance
4. Application hits error path and calls respondWithErrorPage with attacker message
5. Browser renders unescaped payload, executing injected script

How to detect it

Review application logs and web server access logs for error-page requests containing unusual HTML tags, script elements, or encoded payloads; inspect browser console or proxy captures for unexpected script execution on error responses.

What your security team should do

• Immediately upgrade all OpenRefine instances to 3.8.3
• Audit and review any custom or third-party extensions that invoke respondWithErrorPage
• Restrict import of untrusted files until patches are applied
• Monitor upstream for any additional extension-related fixes