GHSA-3pg4-qwc8-426r: Openrefine OpenRefine Leaks Google API Credentials Vulnerability

HIGH
Share
CWE-522
Published
Advisory Summary

GHSA-3pg4-qwc8-426r is a HIGH openrefine leaks google api credentials vulnerability (CWE-522: Insufficiently Protected Credentials) affecting Openrefine libraries in the Maven ecosystem. The issue involves openrefine leaks google api credentials in releases. Remediation is available by upgrading affected packages to version 3.8.3.

GHSA-3pg4-qwc8-426r at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-3pg4-qwc8-426r
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-522: Insufficiently Protected Credentials
Affected Product Openrefine
Package Ecosystem Maven
Published Date
Last Updated

How to Fix GHSA-3pg4-qwc8-426r

To remediate this vulnerability, upgrade all affected Openrefine dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.openrefine:openrefine fixed: 3.8.3 
<dependency>
    <groupId>org.openrefine</groupId>
    <artifactId>openrefine</artifactId>
    <version>3.8.3</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.openrefine

How to Check if You Are Affected

To determine whether your Java application is affected by GHSA-3pg4-qwc8-426r, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.openrefine

Analyze the terminal output to locate any version of Openrefine in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.8.3), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.openrefine command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-522: Insufficiently Protected Credentials, where the product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. In Openrefine, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact OpenRefine releases contain Google API authentication keys ("client id" and "client secret") which can be extracted from released artifacts. For instance, download the package for OpenRefine 3.8.2 on linux. It contains the file `openrefine-3.8.2/webapp/extensions/gdata/module/MOD-INF/lib/openrefine-gdata.jar`, which can be extracted. This archive then contains the file `com/google/refine/extension/gdata/GoogleAPIExtension.java`, which contains the following lines: ```java // For a production release, the second parameter (default value) can be set // for the following three properties (client_id, client_secret, and API key) to // the production values from the Google API console private static final String CLIENT_ID = System.getProperty("ext.gdata.clientid", new String(Base64.getDecoder().decode("ODk1NTU1ODQzNjMwLWhkZWwyN3NxMDM5ZjFwMmZ0aGE2M2VvcWFpY2JwamZoLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29t"))); private static final String CLIENT_SECRET = System.getProperty("ext.gdata.clientsecret", new String(Base64.getDecoder().decode("R2V2TnZiTnA2a3IxeDd5c3VZNENmYlNo"))); ``` The Base64 encoding can then be decoded to obtain the client id and client secret. Those credentials can then be used by other applications to request access to Google accounts, pretending they are OpenRefine. This assumes that they also get access to the user access tokens, which this vulnerability doesn't expose by itself. ### Patches The bundled credentials should be revoked. ### Workarounds Users should revoke access to their Google account if they have connected it to OpenRefine.

GHSA-3pg4-qwc8-426r Affected Openrefine Versions

1 component(s)
Fixed Versions:
3.8.3
Product / Package Ecosystem Affected Versions Fixed Version
org.openrefine:openrefine
maven/org.openrefine/openrefine
Maven
< 3.8.3
3.8.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-3pg4-qwc8-426r
Security Fix Commit FIX COMMIT
https://github.com/OpenRefine/OpenRefine/commit/07dd61e00bb7f472ddcb243631299fba95ad90dd
Openrefine Source Repository REPOSITORY
https://github.com/OpenRefine/OpenRefine

Frequently Asked Questions

What is GHSA-3pg4-qwc8-426r?
GHSA-3pg4-qwc8-426r is a security vulnerability in Openrefine involving OpenRefine leaks Google API credentials in releases under CWE-522: Insufficiently Protected Credentials.
Which Openrefine versions are affected?
Affected versions include releases prior to 3.8.3 across affected packages: org.openrefine:openrefine.
What version fixes GHSA-3pg4-qwc8-426r?
Upgrading to 3.8.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is openrefine affected?
Yes, org.openrefine:openrefine is affected in releases prior to 3.8.3. Upgrade your dependency to 3.8.3 or later.
What CWE is associated with GHSA-3pg4-qwc8-426r?
GHSA-3pg4-qwc8-426r is classified under CWE-522: Insufficiently Protected Credentials (The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.).
How can I check Maven dependencies for GHSA-3pg4-qwc8-426r?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.openrefine'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3pg4-qwc8-426r",
  "modified" : "2024-10-24T18:30:00Z",
  "published" : "2024-10-24T18:30:00Z",
  "aliases" : [ ],
  "summary" : "OpenRefine leaks Google API credentials in releases",
  "details" : "### Impact\n\nOpenRefine releases contain Google API authentication keys (\"client id\" and \"client secret\") which can be extracted from released artifacts. For instance, download the package for OpenRefine 3.8.2 on linux. It contains the file `openrefine-3.8.2/webapp/extensions/gdata/module/MOD-INF/lib/openrefine-gdata.jar`, which can be extracted.\nThis archive then contains the file `com/google/refine/extension/gdata/GoogleAPIExtension.java`, which contains the following lines:\n\n```java\n    // For a production release, the second parameter (default value) can be set\n    // for the following three properties (client_id, client_secret, and API key) to\n    // the production values from the Google API console\n    private static final String CLIENT_ID = System.getProperty(\"ext.gdata.clientid\", new String(Base64.getDecoder().decode(\"ODk1NTU1ODQzNjMwLWhkZWwyN3NxMDM5ZjFwMmZ0aGE2M2VvcWFpY2JwamZoLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29t\")));\n    private static final String CLIENT_SECRET = System.getProperty(\"ext.gdata.clientsecret\", new String(Base64.getDecoder().decode(\"R2V2TnZiTnA2a3IxeDd5c3VZNENmYlNo\")));\n```\n\nThe Base64 encoding can then be decoded to obtain the client id and client secret.\nThose credentials can then be used by other applications to request access to Google accounts, pretending they are OpenRefine. This assumes that they also get access to the user access tokens, which this vulnerability doesn't expose by itself.\n\n### Patches\n\nThe bundled credentials should be revoked.\n\n### Workarounds\n\nUsers should revoke access to their Google account if they have connected it to OpenRefine.\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.openrefine:openrefine"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.8.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-3pg4-qwc8-426r"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OpenRefine/OpenRefine/commit/07dd61e00bb7f472ddcb243631299fba95ad90dd"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/OpenRefine/OpenRefine"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-522" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-10-24T18:30:00Z",
    "nvd_published_at" : null
  }
}