{"id":"CVE-2024-47880","aliases":["GHSA-79jv-5226-783f"],"url":"https://o3.security/vulnerability/CVE-2024-47880","summary":"OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand","details":"### Summary\n\nThe `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request.\n\nAn attacker could lead a user to a malicious page that submits a form POST that contains  embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled `Content-Type` header, and so potentially executed in the victim's browser as if it was part of OpenRefine.\n\nThe attacker must know a valid project ID of a project that contains at least one row.\n\n### Details\n\nThe malicious form sets `contentType` to `text/html` (ExportRowsCommand.java line 101) and `preview` to `true` (line 107). This combination causes the browser to treat what OpenRefine thinks of as an export preview as a regular webpage.\n\nIt would be safer if the `export-rows` command did not allow overriding the Content-Type header at all, instead relying on the exporter to provide the correct Content-Type. It could also require a CSRF token. As an additional measure, it could add a Content-Security-Policy header to the response disabling scripts and such entirely.\n\nAt least the CSV exporter (`separator` and `lineSeparator` fields) and templating exporter (any field) are affected. It may also be possible to inject into the `dateSettings.custom` field or the SQL exporter default value field, if the project contains date or null cells.\n\n### PoC\n\nAn example form that demonstrates the issue is available on https://wandernauta.nl/os/.\n\n### Impact\n\nExecution of arbitrary JavaScript in the user's browser. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present.","published":"2024-10-24T20:21:49.595Z","modified":"2026-10-28T10:54:32.927108071Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"score":0.00356,"percentile":0.29162,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.openrefine:openrefine","fixedVersion":"3.8.3"}],"fix":{"url":"https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d","label":"OpenRefine/OpenRefine@8060477"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47880.json"},{"type":"ADVISORY","url":"https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47880"},{"type":"FIX","url":"https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d"},{"type":"PACKAGE","url":"https://github.com/OpenRefine/OpenRefine"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T10:54:32.927108071Z"}}