CVE-2024-49760

What it actually does

The load-language command constructs a file path from the lang parameter without validating it stays within the expected translations directory, enabling arbitrary JSON file reads via path traversal.

Why it matters to the business

Attackers may read sensitive configuration or data files stored as JSON on the server, leading to information disclosure that could aid further attacks; low EPSS and no known exploitation reduce immediate urgency but affected OpenRefine instances remain exposed until patched.

How an attack unfolds

An attacker sends a malicious lang parameter containing path traversal sequences to the load-language endpoint, causing the application to load and return contents of arbitrary JSON files from the filesystem.

How to fix it

Upgrade to version 3.8.3 or apply the fix in commit d70d9114a8c021a233f0c13c73a0a7784276f2a4; the listed systemd package on SUSE is unrelated to this OpenRefine issue.

How to confirm the fix worked

Verify the application version is 3.8.3 or later; attempt to access a file outside the translations directory using the load-language command and confirm it is rejected.

Typical attack path

1. Identify the vulnerable OpenRefine instance and locate the load-language endpoint
2. Craft a request with a lang parameter using ../ sequences or absolute paths to target desired JSON files
3. Submit the request and inspect the response for unauthorized file contents

How to detect it

Inspect web server logs for requests to the load-language endpoint with suspicious lang parameters containing path traversal sequences like .. or absolute paths.

What your security team should do

• Upgrade all OpenRefine instances to the fixed version immediately
• Review and restrict network access to the load-language endpoint
• Audit logs for suspicious requests to the affected command