CVE-2024-47883
NoneCVSS
—
EPSS
1.6%
Published
Oct 24, 2024
CISA due date
—
Cloudanix analysis
A web application framework used by some data tools could be tricked into loading files or code from the wrong places, potentially letting attackers read private files or run harmful scripts.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- Web Framework
- Class
- Path Traversal
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Improper acceptance of file:/ URLs in place of relative resource names allows fetching and use of attacker-controlled local or remote files as trusted application resources, enabling path traversal, SSRF (including SMB), XSS via arbitrary JavaScript, and RCE via attacker-controlled templates.
Why it matters to the business
Organizations using affected OpenRefine or Butterfly deployments face risk of unauthorized file access, server-side requests to internal resources, browser-based attacks on users, or remote code execution if template names are attacker-influenced; low EPSS and absence from KEV indicate limited observed exploitation but patching remains necessary across SUSE Java packages and Butterfly instances to prevent data exposure or compromise.
How an attack unfolds
An attacker with network access supplies a direct file:/ URL in resource name fields to read server files or perform SSRF; alternatively, a crafted link redirects a user to load attacker JavaScript in the browser, or an attacker influences a template resource name to fetch and execute remote malicious content.
How to fix it
Upgrade OpenRefine/Simile Butterfly to version 1.2.6 or commit 8b22664ca1344e57c2b749c9784c6efd58d43acc; apply SUSE package updates to java-1_8_0-openjdk versions 1.8.0.302-3.55.2 on all listed products including Linux Enterprise Server 15-LTSS, SAP Applications, Manager, and Enterprise Storage.
How to confirm the fix worked
Verify installed Butterfly version is at least 1.2.6 or the listed commit hash; confirm SUSE java-1_8_0-openjdk packages match or exceed the fixed versions via package manager queries; test that direct file:/ URLs are rejected in resource loading paths.
Typical attack path
- Identify application endpoints accepting resource names or URLs for templates, images, or other assets
- Craft and submit requests containing file:/ URLs pointing to local filesystem paths or remote locations
- For client-side attacks, lure authenticated users to a malicious link that triggers loading of attacker-controlled JavaScript
- If template resolution is controllable, supply a resource name that causes the server to fetch and execute attacker-controlled template code
How to detect it
Examine web server and application logs for resource names containing file:/ prefixes or unexpected absolute paths; review outbound connection logs for SMB or other internal resource requests initiated by the application process; inspect for unusual template loading events or JavaScript execution from non-local origins.
What your security team should do
- Prioritize patching all listed SUSE java-1_8_0-openjdk packages and Butterfly deployments to the specified fixed versions within standard change windows
- Review application code for any dynamic construction of resource names or template paths that could be influenced by user input
- Monitor network logs for unexpected outbound requests or file: protocol usage originating from the application
The record
The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer to (what are expected to be) local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local file. However, prior to version 1.2.6, if a `file:/` URL is directly given where a relative path (resource name) is expected, this is also accepted in some code paths; the app then fetches the file, from a remote machine if indicated, and uses it as if it was a trusted part of the app's codebase. This leads to multiple weaknesses and potential weaknesses. An attacker that has network access to the application could use it to gain access to files, either on the the server's filesystem (path traversal) or shared by nearby machines (server-side request forgery with e.g. SMB). An attacker that can lead or redirect a user to a crafted URL belonging to the app could cause arbitrary attacker-controlled JavaScript to be loaded in the victim's browser (cross-site scripting). If an app is written in such a way that an attacker can influence the resource name used for a template, that attacker could cause the app to fetch and execute an attacker-controlled template (remote code execution). Version 1.2.6 contains a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.openrefine.dependencies:butterfly | 0 | 1.2.6 |
| Debian:12 | openrefine-butterfly | 0 | No fix |
| Debian:13 | openrefine-butterfly | 0 | No fix |
| Ubuntu:22.04:LTS | openrefine-butterfly | 0 | No fix |
| Ubuntu:24.04:LTS | openrefine-butterfly | 0 | No fix |
| Ubuntu:24.10 | openrefine-butterfly | 0 | No fix |