David Cruciani

A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade. - Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion Affected versions: flowintel prior to 4.0.0

An issue exists where login email addresses are incorrectly validated. The system calls `Email(email)`, which only constructs a validator object instead of performing actual WTForms field validation. This allows malformed, attacker-controlled email input to proceed through the login process and be written to security-relevant logs, including a warning log and a custom audit logger. Because carriage return (CR) and line feed (LF) characters are not escaped, an unauthenticated attacker can perform log injection by inserting additional physical log lines or forging misleading log entries.

Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name, attribute value, attribute type, comment, first/last seen values, and IDS flag. Although DOMPurify was used to remove XSS vectors, other HTML elements, such as forms, were still permitted, leading to HTML injection.

Authenticated sessions are not revoked when a user changes their password. This allows an attacker with a valid session token to maintain access to the account until the session expires naturally, even after the password has been updated. The issue occurs within the `edit user core()` and `admin edit user core()` functions, where the system fails to call ` invalidate user sessions(user.id)` following a database update.

An issue exists where attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export. This can lead to the unauthorized reading of local files from the Flowintel server, which are then incorporated into the generated export file.

Flowintel improperly trusts configuration keys provided to the alerts settings update endpoint. While configuration values are normalized to Python literals, the keys are used directly to construct and replace lines within the `conf/config module.py` file. The system uses requester-controlled keys in both the regular expression and the generated assignment `f'{key} = {py val}'`, appending the assignment if the key is missing. Because the modified configuration module is subsequently reloaded using `importlib.reload()`, a code-generation boundary is created. This allows specially crafted configuration keys to alter the Python source structure, leading to the execution of attacker-controlled Python statements.

Flowintel allows the `LOG FILE` configuration value to be modified via system settings without restricting it to the intended log directory. This allows an administrator to set `LOG FILE` to an arbitrary filesystem path. Because attackers can influence the content being logged, they can write controlled data into unintended files. This can lead to remote code execution through an exploitation chain where an attacker injects a template into a file and abuses the application rendering behavior. The fix involves the `validate log file name()` function to reject absolute paths, traversal, Windows paths, null bytes, and directory components, while centralizing path construction through `resolve log file path()`.

Stored Cross-Site Scripting (XSS) occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edit notes can store a crafted Mermaid payload that executes JavaScript in the browser of any user who views the affected case note.

Stored Cross-Site Scripting (XSS) occurs because calendar event titles are rendered using `innerHTML`. Since these titles are derived from case titles, a user with permissions to create or modify a case title can inject HTML or script-capable content. This content is subsequently executed by the browser when another user views the calendar. The issue involves the use of `innerHTML` to assign the `arg.event.title` variable.

An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case identifier. Consequently, an authenticated user with editor-level access to one case could substitute a task ID from a different case to perform unauthorized operations. This affects endpoints related to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, and external-reference. Additionally, the system did not verify if a `note id` belonged to the current task during retrieval or export operations.

An authorization flaw exists in the administrative user-edit API. While the system prevents organization administrators from editing users in different organizations, it fails to restrict them from modifying full administrator accounts within their own organization. This allows an organization administrator to change the password of a full administrator, leading to privilege escalation. The issue is addressed by implementing a privilege boundary check using the `is admin()` function to block these modifications.

An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a `user id` parameter to identify the user whose assignments are retrieved, but it lacks proper role-based access control. This allows a lower-privileged authenticated user to access assignment information of other users by providing their respective identifiers.

يحتوي FlowIntel على ثغرة في البرمجة النصية عبر المواقع (XSS) المخزنة، حيث يتم عرض حقول متعددة يتحكم فيها المستخدم أو المسؤول داخل عناصر DOM التي تم تجميعها بواسطة Vue. وعلى الرغم من وجود آلية التهرب القياسية في HTML، إلا أنها تفشل في منع حقن تعبيرات الاستيفاء في Vue باستخدام محددات `[[ ... ]]`. يمكن للمهاجم المصادق عليه تخزين تعبير Vue ضار في حقول مثل عناوين الحالات، ومعرفات التذاكر، ومعلومات الحالات المتكررة، وسمات ملف تعريف المستخدم، وأسماء المؤسسات، وأسماء الأدوار. وعندما يعرض مستخدم آخر المكون المتأثر، يقوم Vue بتقييم التعبير، مما يسمح بتنفيذ JavaScript تعسفي تحت أصل FlowIntel. وقد يؤدي ذلك إلى الكشف غير المصرح به عن المعلومات، أو تنفيذ إجراءات باستخدام جلسة عمل الضحية، أو تعديل بيانات التطبيق.

توجد مشكلة في وظيفة فحص عناوين URL المرجعية الخارجية داخل الملف `app/case/task.py`. يمكن للمهاجم إرسال عنوان URL مرجعي خارجي لإجبار خادم التطبيق على إرسال طلب HTTP HEAD إلى وجهة محددة. ونظرًا لعدم كفاية التحقق من صحة مخطط عنوان URL وعنوان الوجهة الذي تم تحديده، فإن هذا يسمح للطلبات بالوصول إلى موارد الشبكة ذاتية التكرار (loopback) أو المحلية (link-local) أو الخاصة أو المحجوزة أو غيرها من الموارد المقيدة. وقد يتيح ذلك التفاعل مع الخدمات الداخلية أو نقاط نهاية البيانات الوصفية السحابية من سياق شبكة الخادم. ويُعد هذا تزويرًا لطلبات جانب الخادم (SSRF)، والذي يحدث عندما يتم خداع الخادم لإرسال طلبات إلى موقع غير مقصود.