David Cruciani

A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade. - Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion Affected versions: flowintel prior to 4.0.0

An issue exists where login email addresses are incorrectly validated. The system calls `Email(email)`, which only constructs a validator object instead of performing actual WTForms field validation. This allows malformed, attacker-controlled email input to proceed through the login process and be written to security-relevant logs, including a warning log and a custom audit logger. Because carriage return (CR) and line feed (LF) characters are not escaped, an unauthenticated attacker can perform log injection by inserting additional physical log lines or forging misleading log entries.

Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name, attribute value, attribute type, comment, first/last seen values, and IDS flag. Although DOMPurify was used to remove XSS vectors, other HTML elements, such as forms, were still permitted, leading to HTML injection.

Authenticated sessions are not revoked when a user changes their password. This allows an attacker with a valid session token to maintain access to the account until the session expires naturally, even after the password has been updated. The issue occurs within the `edit user core()` and `admin edit user core()` functions, where the system fails to call ` invalidate user sessions(user.id)` following a database update.

An issue exists where attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export. This can lead to the unauthorized reading of local files from the Flowintel server, which are then incorporated into the generated export file.

Flowintel improperly trusts configuration keys provided to the alerts settings update endpoint. While configuration values are normalized to Python literals, the keys are used directly to construct and replace lines within the `conf/config module.py` file. The system uses requester-controlled keys in both the regular expression and the generated assignment `f'{key} = {py val}'`, appending the assignment if the key is missing. Because the modified configuration module is subsequently reloaded using `importlib.reload()`, a code-generation boundary is created. This allows specially crafted configuration keys to alter the Python source structure, leading to the execution of attacker-controlled Python statements.

Flowintel allows the `LOG FILE` configuration value to be modified via system settings without restricting it to the intended log directory. This allows an administrator to set `LOG FILE` to an arbitrary filesystem path. Because attackers can influence the content being logged, they can write controlled data into unintended files. This can lead to remote code execution through an exploitation chain where an attacker injects a template into a file and abuses the application rendering behavior. The fix involves the `validate log file name()` function to reject absolute paths, traversal, Windows paths, null bytes, and directory components, while centralizing path construction through `resolve log file path()`.

Stored Cross-Site Scripting (XSS) occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edit notes can store a crafted Mermaid payload that executes JavaScript in the browser of any user who views the affected case note.

Stored Cross-Site Scripting (XSS) occurs because calendar event titles are rendered using `innerHTML`. Since these titles are derived from case titles, a user with permissions to create or modify a case title can inject HTML or script-capable content. This content is subsequently executed by the browser when another user views the calendar. The issue involves the use of `innerHTML` to assign the `arg.event.title` variable.

An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case identifier. Consequently, an authenticated user with editor-level access to one case could substitute a task ID from a different case to perform unauthorized operations. This affects endpoints related to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, and external-reference. Additionally, the system did not verify if a `note id` belonged to the current task during retrieval or export operations.

An authorization flaw exists in the administrative user-edit API. While the system prevents organization administrators from editing users in different organizations, it fails to restrict them from modifying full administrator accounts within their own organization. This allows an organization administrator to change the password of a full administrator, leading to privilege escalation. The issue is addressed by implementing a privilege boundary check using the `is admin()` function to block these modifications.

An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a `user id` parameter to identify the user whose assignments are retrieved, but it lacks proper role-based access control. This allows a lower-privileged authenticated user to access assignment information of other users by providing their respective identifiers.

FlowIntel contains a stored cross-site scripting issue where multiple user-controlled or administrator-controlled fields are rendered inside DOM elements compiled by Vue. While standard HTML escaping is present, it fails to prevent the injection of Vue interpolation expressions using `[[ ... ]]` delimiters. An authenticated attacker can store a malicious Vue expression in fields such as case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names. When another user views the affected component, Vue evaluates the expression, allowing arbitrary JavaScript execution under the FlowIntel origin. This can lead to unauthorized information exposure, actions performed using the victim's session, or modification of application data.

An issue exists in the external reference URL probe functionality within `app/case/task.py`. An attacker can submit an external reference URL to force the application server to issue an HTTP HEAD request to a specified destination. Due to insufficient validation of the URL scheme and resolved destination address, this allows requests to loopback, link-local, private, reserved, or other restricted network resources. This may enable interaction with internal services or cloud metadata endpoints from the server's network context. This is a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location.