Iglocska

MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility) - The owning organisation could not view proposals on its own org-only attributes Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions. Affected: <2.5.48

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event. This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization. Affected: <2.5.48.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser. Preconditions: - The attacker must be able to control or influence parameter names reported by the misp-modules service. - A victim must be authenticated and view the affected workflow module page. Impact: - Execution of arbitrary JavaScript in the victim's browser session. - Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim. Affected versions: <2.5.48.

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations. An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques. Preconditions: - A linked MISP server relationship exists between the victim instance and the attacker-controlled instance. - The attacker can create or modify tags on the linked server. - A victim user views the remote event preview page. Affected: <2.5.48.

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results. These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces. Preconditions: - An authenticated user with sufficient privileges to delete events in MISP. - The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results. Impact: - Residual sensitive data persists in the database after the parent event is deleted. - Accumulation of orphaned records over time may contribute to storage bloat. - Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event. Affected versions: <2.5.48

MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings. - A module that marks a setting as cli only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction. An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access. Affected: <2.5.48

**اسم البرنامج المصاب والإصدارات المتأثرة** MISP الإصدارات السابقة لـ 2.5.48 **Description** توجد حالة سباق (race condition) في تدفق تسجيل الدخول باستخدام كلمة المرور لمرة واحدة (OTP) عبر البريد الإلكتروني. يحدث هذا لأن قيمة OTP يتم قراءتها من المخزن المشترك، ثم التحقق منها، ثم حذفها في خطوات منفصلة غير ذرية (non-atomic). وبناءً على ذلك، إذا تم إرسال طلبي HTTP يحملان نفس رمز OTP الصالح في وقت واحد، فقد يتمكن كلاهما من المصادقة بنجاح وإنشاء جلسات قبل أن يتم تنفيذ عملية الحذف. يؤدي هذا إلى انتهاك ضمان استخدام الرمز لمرة واحدة وقد يسهل الوصول غير المصرح به في حال تم اعتراض الرمز أو مشاركته. **Recommendations** التحديث إلى الإصدار 2.5.48 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** MISP الإصدارات السابقة لـ 2.5.48 **Description** في الحالات التي يتم فيها تكوين مثيلات MISP لتطلب التسجيل في TOTP عبر `Security.otp required` ، كان فرض إعداد المصادقة الثنائية الإلزامية يقتصر فقط على طلبات المتصفح القياسية. كان بإمكان المستخدم المصادق عليه والذي لم يسجل بعد في TOTP تجاوز هذا الإعداد من خلال إصدار أي نوع من الطلبات غير الخاصة بالمتصفح، بما في ذلك مكالمات AJAX/XHR، أو طلبات REST API، أو عناوين URL بتنسيق `.json` ، أو استعلامات `restSearch` ، أو إجراءات الأتمتة. يحدث هذا لأن أشكال الطلبات القابلة للقراءة آليًا لا يمكنها اتباع إعادة التوجيه التي يستخدمها مسار المتصفح لإرسال المستخدم إلى صفحة التسجيل في TOTP، مما يسمح للمستخدم بالاحتفاظ بالوصول الكامل إلى المثيل دون إكمال إعداد العامل الثاني المطلوب. **Recommendations** التحديث إلى الإصدار 2.5.48 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** MISP الإصدارات السابقة لـ 2.5.48 **الوصف** يوجد خلل في سير عمل حفظ الأحداث يمنع محرك الارتباط من إعادة حساب الارتباطات عند تعديل مستوى توزيع الحدث أو مجموعة المشاركة. يحدث هذا لأن خطاف before-save الداخلي يقوم بتخزين البيانات الجديدة بدلاً من القيم التي تم حفظها مسبقاً، مما يؤدي إلى فشل مقارنة after-save في اكتشاف التغييرات. نتيجة لذلك، تستمر الارتباطات القديمة، مما قد يؤدي إلى كشف معلومات غير مقصودة إذا تم نقل الحدث إلى مجموعة أكثر تقييداً، أو عدم ظهور ارتباطات ذات صلة إذا تم توسيع نطاق التوزيع. يتطلب هذا الخلل وجود مستخدم مصرح له بصلاحية الكتابة لتعديل حقلي `distribution` أو `sharing group id`. **التوصيات** التحديث إلى الإصدار 2.5.48 أو إصدار أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** MISP الإصدارات السابقة لـ 2.5.48 **Description** يوجد خلل في التحقق من الصحة في منطق مزامنة الكائنات. عندما يتم إنشاء كائن MISP بدون وصف، يتم تخزينه بشكل صحيح في النسخة الأصلية، ولكن قاعدة التحقق من الصحة في النسخة المستقبلة ترفضه أثناء عملية النسخ المتماثل لأن حقل الوصف فارغ. يؤدي ذلك إلى قيام النسخة المستقبلة بإسقاط الكائن وجميع السمات المرتبطة به بصمت، مما يؤدي إلى فقدان بيانات استخبارات التهديدات وفقدان سلامة البيانات عبر هيكلية المزامنة. يمكن تفعيل ذلك من قبل أي مستخدم مصرح له يمتلك صلاحيات إنشاء الكائنات. **Recommendations** التحديث إلى الإصدار 2.5.48 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** Critical infrastructure settings, specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin, are exposed through the web UI and API to site-admin users. Because background job workers trust raw Redis job payloads without additional validation, an attacker with a hijacked site-admin session can redirect these settings to an attacker-controlled Redis server and restart the workers. This allows the injection of malicious job payloads, leading to arbitrary command execution as the worker account and potential data exfiltration. Furthermore, the `download attachments on load` setting, which manages inline attachment rendering, is modifiable via the same interface, potentially facilitating client-side attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المصاب والإصدارات المتأثرة** CakePHP (إصدارات متأثرة غير محددة) **الوصف** تفشل الدالة `CakeResponse::download()` في `lib/Cake/Network/CakeResponse.php` في تعقيم أسماء الملفات التي يوفرها المستخدم عند إنشاء رأس Content-Disposition. يؤدي ذلك إلى وجود ناقلين للحقن: يمكن أن يؤدي استخدام أحرف التحكم C0 (CR أو LF) إلى رفض PHP إرسال رأس Content-Disposition بالكامل، مما يؤدي إلى عرض جسم الاستجابة مباشرة في المتصفح، كما يمكن أن يؤدي استخدام علامة الاقتباس المزدوجة إلى إنهاء قيمة السلسلة المقتبسة مبكرًا لحقن معاملات رأس إضافية. يمكن للمستخدم المصرح له تحميل مرفق باسم ملف مصمم خصيصًا، والذي يؤدي عند عرضه من قبل مستخدم مصرح له آخر إلى التلاعب بالرؤوس وتنفيذ HTML أو JavaScript تعسفي. تتيح هذه الحالة حدوث ثغرة cross-site scripting مخزنة، مما قد يؤدي إلى اختطاف الجلسة، وتسريب البيانات، واتخاذ إجراءات غير مصرح بها. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** A cross-site scripting (XSS) issue exists in the TAXII object viewer. The application renders the JSON content of string properties directly into an HTML pre block without proper HTML-encoding when displaying a remote TAXII object. An attacker capable of influencing the content of a TAXII object, such as by publishing a malicious object to a TAXII server that the victim's instance subscribes to, can inject arbitrary HTML or JavaScript. This script executes within the context of the authenticated user's session, potentially leading to the theft of session tokens, API keys, or other sensitive data, and allowing actions to be performed on behalf of the user. **Recommendations** Update to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** The ID Translator feature contains a cross-site scripting (XSS) flaw. When a user accesses the ID Translator page, the application retrieves event identifiers from linked remote servers. Because the application fails to properly encode the event ID returned by the remote server before rendering it in the HTML output, a compromised or malicious linked server can provide a crafted event ID containing arbitrary HTML or JavaScript. This allows the execution of scripts in the browser of an authenticated user, potentially leading to session hijacking or credential theft. **Recommendations** Update to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** A stored cross-site scripting (XSS) issue exists in the index table rendering of the remote event preview. The count field template fails to apply HTML encoding to the field value, although it escapes the associated link URL. An attacker with permissions to create or modify events on a linked remote MISP server can craft an event identifier containing HTML or JavaScript markup. When a user on the local instance views the remote event preview index, the unescaped value is rendered in the browser, enabling arbitrary script execution. This can lead to session hijacking, data exfiltration, or unauthorized actions performed as the authenticated user. **Recommendations** Update to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** Improper access control exists in the attribute search and paginated attribute view endpoints. When an authenticated user with read access to an event owned by another organization queries for soft-deleted attributes, the application discloses those attributes. While the event detail view correctly restricts visibility of soft-deleted attributes to the owning organization and users with sync permissions, the search and paginated view code paths lack this restriction. This can lead to the unauthorized disclosure of sensitive threat intelligence attributes, such as indicators of compromise (IOCs) and context, which the owning organization intended to remove from general visibility. **Recommendations** Update to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** An authorization flaw exists in the correlation handling during attribute searches. The system grants access to correlated attributes and events using a stale distribution snapshot stored on the correlation row instead of the live event access control list. Since the distribution columns in the correlation row are point-in-time copies lacking a published flag, authorization checks fail when an event is restricted, such as when it is unpublished or its sharing group is modified. This allows an authenticated user with read access to some events to retrieve attributes and event metadata from events they are no longer authorized to view. **Recommendations** Update to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to commit 2ffa97f05 **Description** An authorization bypass exists in the related events listing functionality. When a user requests a list of events correlated to a specific event, the system retrieves metadata directly from the correlation table without re-validating the caller's access rights for each related event. Because the correlation table uses a snapshot of the distribution level and sharing group from the time of creation and lacks a published flag, metadata such as titles, dates, and correlating value counts may be disclosed for events that are unpublished or have updated access restrictions. This allows an authenticated user with access to at least one event to perform reconnaissance on threat-intelligence event names and timelines across different sharing groups. **Recommendations** Update to the version containing commit 2ffa97f05.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** Improper input validation exists in the decaying model import functionality. The import endpoint was designed to create a new decaying model restricted to the importing user's organization with the default flag disabled. However, the application only stripped top-level `id` and `uuid` fields and pinned `org id` and `default` on the outer array. An authenticated user with `perm decaying` permissions could provide a nested model key containing its own primary key, organization identifier, and default flag to bypass these restrictions during the save operation. This could allow a user to overwrite existing decaying models from other organizations, modify models flagged as organization defaults to affect scoring behavior, or reassign a model's organization to an arbitrary value. **Recommendations** Update to version 2.5.48 or later.