Elhoim

MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility) - The owning organisation could not view proposals on its own org-only attributes Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions. Affected: <2.5.48

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event. This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization. Affected: <2.5.48.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** An authorization flaw exists in the correlation handling during attribute searches. The system grants access to correlated attributes and events using a stale distribution snapshot stored on the correlation row instead of the live event access control list. Since the distribution columns in the correlation row are point-in-time copies lacking a published flag, authorization checks fail when an event is restricted, such as when it is unpublished or its sharing group is modified. This allows an authenticated user with read access to some events to retrieve attributes and event metadata from events they are no longer authorized to view. **Recommendations** Update to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** Improper access control exists in the attribute search and paginated attribute view endpoints. When an authenticated user with read access to an event owned by another organization queries for soft-deleted attributes, the application discloses those attributes. While the event detail view correctly restricts visibility of soft-deleted attributes to the owning organization and users with sync permissions, the search and paginated view code paths lack this restriction. This can lead to the unauthorized disclosure of sensitive threat intelligence attributes, such as indicators of compromise (IOCs) and context, which the owning organization intended to remove from general visibility. **Recommendations** Update to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** misp-modules (affected versions not specified) **Description** The `cisco firesight manager ACL rule export` module generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values and MISP attribute values—such as destination IPs, URLs, and event info comments—directly into single-quoted shell string assignments without escaping or sanitization. An attacker can inject arbitrary shell commands by submitting MISP events or attributes containing a single-quote character, which breaks the quoting context. A security analyst executing the resulting script would run these commands with their own privileges, potentially compromising their workstation or exposing fireSIGHT Manager credentials. Additionally, the module contains a defect where the `config` variable is referenced unconditionally despite being assigned only within a conditional block, leading to a NameError and causing a denial of service when the request payload lacks a `config` key. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.46 **Description** The LdapAuth and LinOTPAuth authentication plugins contain an authentication bypass. The `LdapAuthenticate` and `LinOTPAuthenticate` functions fail to implement the ` checkFields()` input validation guard, allowing email and password fields from login requests to be processed without verifying they are non-empty strings. In the LDAP authenticator, an empty or null password is sent to `ldap bind()`, which may be accepted as a successful unauthenticated bind by many LDAP directory servers. This allows an attacker with a valid user email address to authenticate without a password. Non-string values may also cause TypeErrors or be misinterpreted in ` findUser()`. In the LinOTP authenticator, non-string credentials can be concatenated into verification requests, and empty passwords may be accepted against stored hashes of empty strings. Additionally, auto-provisioned LDAP accounts may be assigned and store a hash of an empty password, allowing access via mixed-authentication fallback if the user is no longer in LDAP. Exploitation requires the affected plugin to be enabled and knowledge of a valid email address, granting the attacker the full privileges of the impersonated user. **Recommendations** Update MISP to version 2.5.46 or later. As a temporary workaround, disable the `LdapAuth` and `LinOTPAuth` plugins until the update is applied.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authorization flaw allows an authenticated user to submit a `sharing group id` without verification of their authorization to use the referenced Sharing Group. In workflows for creating and editing attributes and Galaxy Clusters, validation was only triggered when the distribution field was explicitly set to 4 (Sharing Group). By omitting the distribution parameter or avoiding this specific condition, a user can bypass the authorization check. This enables a user with permissions to create or modify MISP objects to associate data with an unauthorized Sharing Group, potentially bypassing information-sharing boundaries and resulting in the unauthorized distribution of data to other group members. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An incorrect authorization flaw allows authenticated users to delete attributes from events without possessing the required `perm modify` or `perm modify org` permissions. The issue occurs because the `MispAttribute::deleteAttribute()` function performs organization membership checks but fails to consistently enforce event modification authorization rules. This creates a discrepancy where attribute editing is correctly restricted via `ACL::canModifyEvent()`, but deletion operations can bypass these checks. An authenticated attacker who is a member of the organization owning an event can exploit this to remove individual or bulk attributes, leading to unauthorized modification or loss of threat intelligence data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An improper TLS certificate validation issue exists in the `CurlClient` component. The `CurlClient::$verifyPeer` property was not explicitly initialized, defaulting to null, which effectively disabled TLS peer verification during cURL operations unless explicitly enabled by the calling code. This allows HTTPS connections to accept certificates not issued by a trusted certificate authority. A man-in-the-middle attack could be performed by an attacker capable of intercepting network traffic between a MISP instance and a remote HTTPS service to impersonate the endpoint. This could lead to the observation of sensitive information, such as authentication material and threat intelligence, or the modification of responses returned to the MISP instance. **Recommendations** Apply the available patch to enable TLS peer verification by default and correct self-signed certificate handling in the `SyncTool` component.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authentication bypass exists in the LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom `LdapAuthenticate` and `LinOTPAuthenticate` components failed to replicate the credential validation checks of CakePHP's `FormAuthenticate` implementation, allowing empty or non-string values to reach authentication mechanisms. In the LDAP path, an attacker with a valid directory user's email could submit an empty password; if the LDAP server accepts unauthenticated binds via the `ldap bind()` function, the attacker could impersonate the user. In the LinOTP component, invalid credential types were not rejected, and when mixed authentication was enabled, empty passwords could be validated against local hashes. Additionally, LDAP-provisioned accounts could be created with empty local passwords, allowing authentication via the local fallback mechanism if LDAP resolution failed. Successful exploitation allows a remote unauthenticated attacker to impersonate users, potentially gaining administrative access to sensitive threat-intelligence data and system configurations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authorization flaw exists in the OnDemand correlation engine where correlations are calculated based only on matching attribute values, ignoring distribution, sharing group, organization, and other access-control restrictions. This allows an authenticated low-privileged user to receive correlation results for attributes or events they are not authorized to access by querying or creating attributes that correlate with restricted content. The issue stems from the correlation collection path failing to account for the requesting user and the use of potentially stale denormalized access-control information in paths relying on stored correlation data. The system utilizes the `fetchAttributesSimple()` function to evaluate restrictions against live data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** A reflected Cross-Site Scripting (XSS) issue exists in the event attribute filtering query builder. The `taggedAttributes` and `galaxyAttachedAttributes` URL parameters are inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded within a `<script>` element. Because `JsonTool::encode()` uses `JSON UNESCAPED SLASHES`, a value containing a closing `</script>` sequence can terminate the script element and inject arbitrary HTML or JavaScript. An attacker can exploit this by tricking an authenticated user into following a crafted URL, executing malicious JavaScript within the security context of the MISP instance and the victim's session privileges. This may lead to unauthorized data access or modification based on the victim's permissions. **Recommendations** Apply HTML escaping using the `h()` function to both scalar and array values before they are inserted into the DOM. As a temporary mitigation, avoid using the `taggedAttributes` and `galaxyAttachedAttributes` parameters in the event attribute filtering query builder.