CSRF Vulnerability in OpenRefine Leading to Remote Code Execution

OpenRefine versions through 3.10.1 contain a critical cross-site request forgery (CSRF) vulnerability residing within the get-rows command. This flaw allows a remote, unauthenticated attacker to execute arbitrary Jython facet expressions on the host server by inducing an authenticated OpenRefine user to visit a malicious, attacker-controlled webpage. Because OpenRefine facilitates data processing, the ability to inject and execute Jython code via the engine parameter during a cross-origin GET request can result in full remote command execution (RCE) with the privileges of the user running the OpenRefine application. This is particularly significant for local instances where the application is intended for trusted data cleaning but may be exposed to browser-based threats from the user's active session.

Impact

Successful exploitation allows for remote command execution under the security context of the user running OpenRefine. This can lead to complete host compromise, unauthorized access to sensitive datasets processed by the application, and the potential for lateral movement within the network if the instance is deployed in a multi-user or server-based environment.

Recommendation

Prioritized actions for security teams:

• Identify all instances of OpenRefine running in the environment using asset management tools or process monitoring.
• Upgrade all OpenRefine installations to a patched version beyond 3.10.1 as soon as an update is released by the vendor.
• Implement restrictive network access controls to ensure the OpenRefine management interface is not accessible from external, untrusted network segments.
• Disable Jython script execution features if they are not required for specific data transformation workflows.