OpenRefine Zip Slip Path Traversal Vulnerability (CVE-2023-46751) Advisory

Key Information Vulnerability Name: OpenRefine Zip Slip Vulnerability CVE ID: CVE-2023-46751 CVSS Score: 9.8 (Critical) Affected Versions: OpenRefine 3.6.0 and earlier Fixed Version: OpenRefine 3.6.1 Vulnerability Description OpenRefine is an open-source data cleaning and transformation tool widely used for data processing tasks. The tool allows users to import data files in various formats, including ZIP files. However, a critical security vulnerability, known as the Zip Slip vulnerability, exists when processing ZIP files. Impact Attackers can exploit this vulnerability by crafting malicious ZIP files to execute arbitrary code or overwrite critical files on the target system. This could lead to data leakage, system crashes, or full system compromise. Technical Details Vulnerability Discovery The SonarQube team discovered this vulnerability during a code analysis of OpenRefine. Specifically, when OpenRefine extracts ZIP files, it fails to properly validate the extraction path, allowing attackers to perform path traversal attacks using specially crafted ZIP files. Exploitation An attacker can create a ZIP file containing malicious paths, such as , and upload it to OpenRefine. When OpenRefine extracts the file, it writes the contents to arbitrary locations on the target system, enabling file overwrites or execution of malicious code. Mitigation The OpenRefine team fixed this vulnerability in version 3.6.1. The fixes include: 1. Adding path validation logic to ensure extraction paths do not exceed expected boundaries. 2. Updating dependencies to use more secure ZIP extraction methods. Timeline 2023-09-01: Vulnerability discovered and reported to the OpenRefine team. 2023-09-15: OpenRefine team confirmed the vulnerability and began remediation. 2023-10-01: OpenRefine 3.6.1 released, addressing the vulnerability. Summary The Zip Slip vulnerability is a common security issue, especially when handling user-uploaded ZIP files. The OpenRefine vulnerability serves as a reminder to developers that strict path validation is essential during file extraction operations to prevent path traversal attacks. Promptly updating software and dependencies remains an effective defense against such vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

OpenRefine Zip Slip Path Traversal Vulnerability (CVE-2023-46751) Advisory