Remote Code Execution

2023-09-1408:35:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

remote code execution

openrefine

rdbms

jdbc

mysql

deserialization

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.005

Percentile

75.5%

JSON

org.openrefine, database is vulnerable to Remote Code Execution (RCE). The vulnerability is caused by not validating or sanitizing/escaping the JDBC connection url used while importing data from RDBMS. This can cause an unauthenticated attacker to run arbritrary code on the openfire server by using existing JDBC connection url attacks like MySQL JDBC Deserialization attack using autoDeserialize and queryInterceptors parameters in the JDBC connection string.