CVE-2022-41401
Published: 04 August 2023
Summary
CVE-2022-41401 is a medium-severity SSRF (CWE-918) vulnerability in Openrefine Openrefine. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
OpenRefine versions up to 3.5.2 contain a Server-Side Request Forgery vulnerability tracked as CVE-2022-41401 and assigned CWE-918. The flaw resides in the importing utilities component and carries a CVSS 3.1 score of 6.5 reflecting network attack vector, low complexity, and low-privileged access that results in high confidentiality impact without affecting integrity or availability.
An authenticated attacker with low privileges can supply crafted input that causes the server to issue requests to arbitrary internal endpoints, enabling unauthorized access to internal resources and disclosure of sensitive files.
The provided references consist of source-code links and a proof-of-concept repository but contain no advisory statements or patch details. The associated EPSS score remains flat at 0.0531 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2337
Vulnerability details
OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.