Peter James

A cross-site request forgery (CSRF) issue exists in the sharing group quick-edit functionality. The `addOrg`, `removeOrg`, `addServer`, and `removeServer` actions utilize the ` initialiseSGQuickEdit()` helper, where the HTTP method validation meant to restrict operations to POST requests was disabled. Consequently, these state-changing actions can be triggered via GET requests. An attacker could trick an authenticated user with sufficient privileges into clicking a malicious link, allowing the attacker to modify sharing group memberships by adding or removing organizations or servers. This could lead to unauthorized access to distributed information or the disruption of legitimate information sharing.

A cross-site request forgery (CSRF) issue occurs because the system disables form-security and CSRF protections if a request is identified as REST traffic. This detection can be manipulated by an attacker using the HTTP Accept header (e.g., `Accept: application/json`), which can be sent from a cross-origin page without a CORS preflight. Consequently, the system may treat a request from a malicious website as REST traffic and bypass security validations while using the victim's authenticated browser session. An attacker could trick an authenticated user into visiting a malicious page to execute unauthorized state-changing requests to susceptible endpoints, potentially leading to the unauthorized modification, creation, publication, or removal of data. The issue stems from the ` isRest()` function granting security exemptions based on request type rather than the authentication mechanism.

An issue in the email-based one-time password (OTP) authentication flow allows an attacker to perform an unrestricted number of OTP verification attempts. The `email otp()` endpoint lacks brute-force protection when validating submitted OTP values. An attacker who has passed the primary authentication stage can repeatedly submit candidate OTP values while the same OTP remains valid, increasing the likelihood of guessing the code and bypassing the second authentication factor to gain unauthorized account access. This is further complicated because the OTP is linked to the user instead of a specific login session, enabling multiple concurrent sessions to guess the same valid OTP.

A persistent unsafe URL injection exists in the ButtonWidget configuration of the dashboard. The issue occurs because dashboard widget URLs were validated only during rendering and not when the configuration was saved. This allows an authenticated user with permissions to modify dashboard settings to persist arbitrary URL values, including those using the `javascript:` scheme. If these values reach a rendering or navigation path that lacks runtime validation, it could lead to client-side script execution within the security context of the MISP session. This could enable an attacker to perform actions using the privileges of the affected user or access session-specific information. This flaw is characterized as a persistence-layer validation gap and a defense-in-depth weakness.

An authenticated user with permissions to create or modify event templates can bypass validation of the template definition field. The `EventTemplate::beforeValidate()` method only performs semantic validation if the definition is an array; if a pre-encoded string containing malformed JSON or an unexpected data type is provided, it bypasses `validateDefinition()` and is stored in the database. Subsequently, the `EventTemplate::afterFind()` method uses `JsonTool::decode()` to retrieve the definition without handling decoding failures. This can trigger exceptions and cause HTTP 500 errors for all authenticated users accessing the event template index or other functionality relying on `EventTemplate` queries, resulting in a persistent denial of service. Additionally, JSON representing an unexpected type may lead to invalid data reaching downstream consumers.

A session fixation issue exists in the CustomAuth authentication flow. The system stores the authenticated user identity in the existing session without rotating the session identifier. This allows an attacker to use a pre-known session identifier to hijack a victim's authenticated session and gain their account privileges. The flaw occurs because the ` customAuthentication()` function writes the user into the CakePHP session while the `Session->renew()` call is disabled.

A cross-site request forgery (CSRF) issue exists in the `cullEmptyEvents` action. The endpoint performs a state-changing and irreversible operation while accepting HTTP GET requests. Since bodyless GET requests bypass CakePHP CSRF validation, an attacker can trick an authenticated user with sufficient privileges into invoking the endpoint by loading a crafted URL. This results in the deletion of published empty events using `skipBlocklist`, which prevents the creation of blocklist entries and makes the deletion irreversible and untrackable during synchronization.