CVE-2024-47883: OpenRefine Butterfly RCE Vulnerability

CVE-2024-47883 Overview

CVE-2024-47883 is a critical vulnerability in the OpenRefine fork of the MIT Simile Butterfly server, a modular web application framework. The vulnerability stems from improper handling of URL resources in the java.net.URL class, which is used to reference local resource files such as images and templates. When a file:/ URL is directly provided where a relative path is expected, the application incorrectly accepts this input in certain code paths, fetching files from potentially untrusted sources and treating them as legitimate parts of the application's codebase.

This flaw enables multiple attack vectors including path traversal, server-side request forgery (SSRF), cross-site scripting (XSS), and remote code execution (RCE) through attacker-controlled templates.

Critical Impact

Attackers with network access can exploit this vulnerability to access sensitive files on the server's filesystem, execute arbitrary JavaScript in victim browsers, or achieve remote code execution through malicious template injection.

Affected Products

• OpenRefine Butterfly (versions prior to 1.2.6)
• Applications built on the Simile Butterfly framework
• Systems using OpenRefine with vulnerable Butterfly dependencies

Discovery Timeline

• 2024-10-24 - CVE CVE-2024-47883 published to NVD
• 2024-10-29 - Last updated in NVD database

Technical Details for CVE-2024-47883

Vulnerability Analysis

The OpenRefine Butterfly framework utilizes the java.net.URL class to handle resource file references within the application. Under normal operation, this mechanism opens connections to local files when provided with relative paths. However, the vulnerability arises because certain code paths accept absolute file:/ URLs instead of the expected relative resource names.

When an attacker supplies a crafted file:/ URL, the application processes it without proper validation, potentially fetching resources from remote machines or local filesystem locations outside the intended scope. This improper input validation affects both CWE-22 (Path Traversal) and CWE-36 (Absolute Path Traversal) vulnerability categories.

The attack surface is particularly dangerous because it combines multiple weaknesses: unauthorized file access, SSRF capabilities (including SMB protocol exploitation on Windows systems), XSS through attacker-controlled JavaScript loading, and RCE when template resources can be influenced by attackers.

Root Cause

The root cause is insufficient input validation in the Butterfly framework's resource loading mechanism. The application fails to properly distinguish between legitimate relative resource paths and absolute file:/ URLs. This allows external, potentially malicious resources to be loaded and processed with the same trust level as local application resources. The framework should enforce strict path validation to ensure only relative paths within the application's resource directory are accepted.

Attack Vector

The vulnerability is exploitable via network access without requiring authentication or user interaction. An attacker can exploit this vulnerability through several methods:

1. Path Traversal: Direct network access to the application allows reading arbitrary files from the server's filesystem by crafting URLs with path traversal sequences
2. Server-Side Request Forgery: Attackers can force the server to make requests to internal or external resources, potentially accessing SMB shares on Windows networks
3. Cross-Site Scripting: By redirecting users to crafted URLs within the application, attackers can load arbitrary JavaScript in the victim's browser context
4. Remote Code Execution: If template resource names can be influenced by attackers, malicious templates can be fetched and executed server-side

The vulnerability can be triggered by manipulating resource path parameters to include absolute file:/ URLs, causing the server to fetch and process untrusted content. Detailed technical information is available in the GitHub Security Advisory GHSA-3p8v-w8mr-m3x8.

Detection Methods for CVE-2024-47883

Indicators of Compromise

• Unexpected outbound network connections from the Butterfly application server to external resources
• Access logs showing requests containing file:/ URLs or path traversal patterns (../, ..\\)
• Server-side access to sensitive files outside the application's resource directory
• Unusual SMB traffic originating from the application server to internal network hosts

Detection Strategies

• Monitor HTTP request parameters for file:/ URL schemes and absolute path indicators
• Implement web application firewall (WAF) rules to detect and block path traversal patterns
• Enable verbose logging on the Butterfly framework to capture resource loading operations
• Deploy network monitoring to detect anomalous outbound connections from application servers

Monitoring Recommendations

• Configure alerts for file access patterns indicating path traversal attempts
• Monitor for SSRF indicators such as requests to internal IP ranges or localhost
• Review application logs for template loading from unexpected sources
• Implement file integrity monitoring on critical server directories

How to Mitigate CVE-2024-47883

Immediate Actions Required

• Upgrade OpenRefine Butterfly to version 1.2.6 or later immediately
• Review network access controls to limit unnecessary inbound connections to Butterfly applications
• Implement input validation at the application layer to reject absolute URLs in resource paths
• Audit recent logs for signs of exploitation attempts

Patch Information

OpenRefine has released version 1.2.6 of the Butterfly framework which contains the security patch for this vulnerability. The fix is available in commit 537f64bfa72746f8b21d4bda461fad843435319c. Organizations should update to the patched version as soon as possible.

For additional details, refer to the GitHub Security Advisory GHSA-3p8v-w8mr-m3x8.

Workarounds

• Restrict network access to Butterfly applications using firewall rules to limit exposure
• Implement a reverse proxy with URL filtering to block requests containing suspicious patterns
• Disable or restrict template loading functionality if not required for application operation
• Apply network segmentation to prevent SSRF attacks from reaching internal resources