Andras Iklody

An incorrect authorization flaw allows authenticated users to delete attributes from events without possessing the required `perm modify` or `perm modify org` permissions. The issue occurs because the `MispAttribute::deleteAttribute()` function performs organization membership checks but fails to consistently enforce event modification authorization rules. This creates a discrepancy where attribute editing is correctly restricted via `ACL::canModifyEvent()`, but deletion operations can bypass these checks. An authenticated attacker who is a member of the organization owning an event can exploit this to remove individual or bulk attributes, leading to unauthorized modification or loss of threat intelligence data.

An authorization flaw allows an authenticated user to submit a `sharing group id` without verification of their authorization to use the referenced Sharing Group. In workflows for creating and editing attributes and Galaxy Clusters, validation was only triggered when the distribution field was explicitly set to 4 (Sharing Group). By omitting the distribution parameter or avoiding this specific condition, a user can bypass the authorization check. This enables a user with permissions to create or modify MISP objects to associate data with an unauthorized Sharing Group, potentially bypassing information-sharing boundaries and resulting in the unauthorized distribution of data to other group members.

A cross-site request forgery (CSRF) issue exists in the sharing group quick-edit functionality. The `addOrg`, `removeOrg`, `addServer`, and `removeServer` actions utilize the ` initialiseSGQuickEdit()` helper, where the HTTP method validation meant to restrict operations to POST requests was disabled. Consequently, these state-changing actions can be triggered via GET requests. An attacker could trick an authenticated user with sufficient privileges into clicking a malicious link, allowing the attacker to modify sharing group memberships by adding or removing organizations or servers. This could lead to unauthorized access to distributed information or the disruption of legitimate information sharing.

A cross-site request forgery (CSRF) issue occurs because the system disables form-security and CSRF protections if a request is identified as REST traffic. This detection can be manipulated by an attacker using the HTTP Accept header (e.g., `Accept: application/json`), which can be sent from a cross-origin page without a CORS preflight. Consequently, the system may treat a request from a malicious website as REST traffic and bypass security validations while using the victim's authenticated browser session. An attacker could trick an authenticated user into visiting a malicious page to execute unauthorized state-changing requests to susceptible endpoints, potentially leading to the unauthorized modification, creation, publication, or removal of data. The issue stems from the ` isRest()` function granting security exemptions based on request type rather than the authentication mechanism.

An improper TLS certificate validation issue exists in the `CurlClient` component. The `CurlClient::$verifyPeer` property was not explicitly initialized, defaulting to null, which effectively disabled TLS peer verification during cURL operations unless explicitly enabled by the calling code. This allows HTTPS connections to accept certificates not issued by a trusted certificate authority. A man-in-the-middle attack could be performed by an attacker capable of intercepting network traffic between a MISP instance and a remote HTTPS service to impersonate the endpoint. This could lead to the observation of sensitive information, such as authentication material and threat intelligence, or the modification of responses returned to the MISP instance.

A persistent unsafe URL injection exists in the ButtonWidget configuration of the dashboard. The issue occurs because dashboard widget URLs were validated only during rendering and not when the configuration was saved. This allows an authenticated user with permissions to modify dashboard settings to persist arbitrary URL values, including those using the `javascript:` scheme. If these values reach a rendering or navigation path that lacks runtime validation, it could lead to client-side script execution within the security context of the MISP session. This could enable an attacker to perform actions using the privileges of the affected user or access session-specific information. This flaw is characterized as a persistence-layer validation gap and a defense-in-depth weakness.

An authentication bypass exists in the LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom `LdapAuthenticate` and `LinOTPAuthenticate` components failed to replicate the credential validation checks of CakePHP's `FormAuthenticate` implementation, allowing empty or non-string values to reach authentication mechanisms. In the LDAP path, an attacker with a valid directory user's email could submit an empty password; if the LDAP server accepts unauthenticated binds via the `ldap bind()` function, the attacker could impersonate the user. In the LinOTP component, invalid credential types were not rejected, and when mixed authentication was enabled, empty passwords could be validated against local hashes. Additionally, LDAP-provisioned accounts could be created with empty local passwords, allowing authentication via the local fallback mechanism if LDAP resolution failed. Successful exploitation allows a remote unauthenticated attacker to impersonate users, potentially gaining administrative access to sensitive threat-intelligence data and system configurations.

An issue in the email-based one-time password (OTP) authentication flow allows an attacker to perform an unrestricted number of OTP verification attempts. The `email otp()` endpoint lacks brute-force protection when validating submitted OTP values. An attacker who has passed the primary authentication stage can repeatedly submit candidate OTP values while the same OTP remains valid, increasing the likelihood of guessing the code and bypassing the second authentication factor to gain unauthorized account access. This is further complicated because the OTP is linked to the user instead of a specific login session, enabling multiple concurrent sessions to guess the same valid OTP.

A cross-site request forgery (CSRF) issue exists in the `cullEmptyEvents` action. The endpoint performs a state-changing and irreversible operation while accepting HTTP GET requests. Since bodyless GET requests bypass CakePHP CSRF validation, an attacker can trick an authenticated user with sufficient privileges into invoking the endpoint by loading a crafted URL. This results in the deletion of published empty events using `skipBlocklist`, which prevents the creation of blocklist entries and makes the deletion irreversible and untrackable during synchronization.

A reflected Cross-Site Scripting (XSS) issue exists in the event attribute filtering query builder. The `taggedAttributes` and `galaxyAttachedAttributes` URL parameters are inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded within a `<script>` element. Because `JsonTool::encode()` uses `JSON UNESCAPED SLASHES`, a value containing a closing `</script>` sequence can terminate the script element and inject arbitrary HTML or JavaScript. An attacker can exploit this by tricking an authenticated user into following a crafted URL, executing malicious JavaScript within the security context of the MISP instance and the victim's session privileges. This may lead to unauthorized data access or modification based on the victim's permissions.

An authenticated user with permissions to create or modify event templates can bypass validation of the template definition field. The `EventTemplate::beforeValidate()` method only performs semantic validation if the definition is an array; if a pre-encoded string containing malformed JSON or an unexpected data type is provided, it bypasses `validateDefinition()` and is stored in the database. Subsequently, the `EventTemplate::afterFind()` method uses `JsonTool::decode()` to retrieve the definition without handling decoding failures. This can trigger exceptions and cause HTTP 500 errors for all authenticated users accessing the event template index or other functionality relying on `EventTemplate` queries, resulting in a persistent denial of service. Additionally, JSON representing an unexpected type may lead to invalid data reaching downstream consumers.

A session fixation issue exists in the CustomAuth authentication flow. The system stores the authenticated user identity in the existing session without rotating the session identifier. This allows an attacker to use a pre-known session identifier to hijack a victim's authenticated session and gain their account privileges. The flaw occurs because the ` customAuthentication()` function writes the user into the CakePHP session while the `Session->renew()` call is disabled.

An authorization flaw exists in the OnDemand correlation engine where correlations are calculated based only on matching attribute values, ignoring distribution, sharing group, organization, and other access-control restrictions. This allows an authenticated low-privileged user to receive correlation results for attributes or events they are not authorized to access by querying or creating attributes that correlate with restricted content. The issue stems from the correlation collection path failing to account for the requesting user and the use of potentially stale denormalized access-control information in paths relying on stored correlation data. The system utilizes the `fetchAttributesSimple()` function to evaluate restrictions against live data.

An improper authorization check in the attribute creation endpoint allows an authenticated user with permissions to add attributes to submit a `sharing group id` without triggering the required authorization check, provided the attribute distribution value is not set to 4 (sharing group). This access-control bypass enables users to associate attributes with sharing groups they are not authorized to use, potentially compromising the integrity of sharing metadata and exposing restricted sharing group relationships.

Broken access-control flaws exist where authorization checks are performed against incorrect entities or ownership and editability checks are missing on write paths. This allows a lower-privileged authenticated user with specific feature permissions to authorize one object while mutating another, or modify objects that are visible but not editable by their organization. Affected areas include - Event Reports tag removal: The route-authorized report may differ from the report ID used for tag detachment, allowing cross-organization tag removal. - Collection Elements bulk deletion: Authorization occurs against a collection whose ID matches the collection-element row ID instead of the actual parent collection, allowing deletion of elements from collections not owned by the user. - Analyst Data capture/update: Nested updates may overwrite records without the `canEditAnalystData()` ownership check, enabling cross-organization overwrites. - Template Elements editing: Authorization occurs against a template whose ID matches the template-element ID instead of the parent template, allowing unauthorized edits to other organizations' template elements. - Decaying Model editing and mappings: Write paths load models using view-scope access without verifying edit ownership, allowing users to edit or remap visible models owned by other organizations.

The Azure Active Directory (AAD) authentication implementation contains multiple weaknesses in its OAuth 2.0 authorization flow. The application uses the PHP session identifier `session id()` as the OAuth state parameter, which can leak valid session tokens through browser history, HTTP Referer headers, reverse proxies, or access logs, potentially leading to session hijacking. The implementation fails to regenerate the session identifier after successful authentication, making sessions susceptible to session fixation. Furthermore, the OAuth state value is not a single-use nonce, weakening CSRF protections and increasing the risk of replay attacks. The flow does not enforce HTTPS for the configured OAuth redirect URI, allowing authorization codes and access tokens to be transmitted in plaintext. Additionally, OAuth error responses containing attacker-controlled GET parameters are logged without sanitization, enabling log forging or log injection.

Broken access-control checks exist in the bulk deletion flows for Event Reports and Sharing Groups. The `deleteSelection` handlers authorized deletions using broad role-level permissions instead of validating authorization for each selected object. For Event Reports, the `EventReportsController::deleteSelection` function relied on the global `perm add` capability, allowing contributor-level users to hard-delete reports belonging to other organizations by submitting report IDs or UUIDs. For Sharing Groups, the `SharingGroupsController::deleteSelection` function relied on the global `perm sharing group` capability, enabling users to delete sharing groups owned by other organizations. An authenticated attacker with these broad role permissions could delete objects outside their organization's authorization scope, leading to the loss of event-report content or sharing-group configurations across the instance.

A site administrator can configure an arbitrary filesystem path for the NDJSON error log used by `JsonLogTool`. Since log entries can contain attacker-controlled content, an authenticated attacker with site administrator privileges can direct log output to a PHP file within a web-accessible directory and inject PHP code. Accessing this file allows for remote code execution with the privileges of the web server process.

An authenticated site administrator can set the `Kafka rdkafka config` setting to an arbitrary filesystem path. The system parses the referenced INI file and passes its options to rdkafka. By using a crafted configuration file hosted in a MISP-writable location, such as an uploaded file or administrative image, an attacker can use rdkafka options like `plugin.library.paths` to load an external library, leading to arbitrary code execution with the privileges of the MISP process.

Multiple core controllers and model capture paths accept client-controlled request fields, including primary keys (`id`) and ownership or scope foreign keys such as `event id`, `org id`, `user id`, `sharing group id`, `galaxy cluster uuid`, `organisation uuid`, and related nested object identifiers, without consistent stripping, pinning, or revalidation against server-authorized objects. An authenticated user with access to one authorized object can submit crafted REST or form payloads to save data against a different object than the one verified by authorization logic. This can lead to object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event or object injection, proposal retargeting, or stored attacker-controlled content appearing in another user's context. The issue stems from the `CRUDComponent::edit()` function copying supplied fields, including a payload primary key, onto the loaded record, which allows the CakePHP `save()` function to update an arbitrary row if the loaded ID is not re-pinned.