David Cruciani

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** An issue exists where login email addresses are incorrectly validated. The system calls `Email(email)`, which only constructs a validator object instead of performing actual WTForms field validation. This allows malformed, attacker-controlled email input to proceed through the login process and be written to security-relevant logs, including a warning log and a custom audit logger. Because carriage return (CR) and line feed (LF) characters are not escaped, an unauthenticated attacker can perform log injection by inserting additional physical log lines or forging misleading log entries. **Recommendations** For versions 3.3.0 and later, update the software to the patched version that corrects the validation call to `Email()(form, form.email)`, implements parameterized logging, and utilizes the ` sanitize log fragment()` function to encode carriage returns and line feeds.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name, attribute value, attribute type, comment, first/last seen values, and IDS flag. Although DOMPurify was used to remove XSS vectors, other HTML elements, such as forms, were still permitted, leading to HTML injection. **Recommendations** For versions 3.3.0 and later, update the software to a version where direct string interpolation is replaced with DOM construction via `document.createElement()` and attacker-controlled values are assigned using `textContent`.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Authenticated sessions are not revoked when a user changes their password. This allows an attacker with a valid session token to maintain access to the account until the session expires naturally, even after the password has been updated. The issue occurs within the `edit user core()` and `admin edit user core()` functions, where the system fails to call ` invalidate user sessions(user.id)` following a database update. **Recommendations** Update Flowintel to a version where the `edit user core()` and `admin edit user core()` functions explicitly invoke ` invalidate user sessions(user.id)` upon password changes.

**Name of the Vulnerable Software and Affected Versions** Flowintel (affected versions not specified) **Description** An issue exists where attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export. This can lead to the unauthorized reading of local files from the Flowintel server, which are then incorporated into the generated export file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Flowintel improperly trusts configuration keys provided to the alerts settings update endpoint. While configuration values are normalized to Python literals, the keys are used directly to construct and replace lines within the `conf/config module.py` file. The system uses requester-controlled keys in both the regular expression and the generated assignment `f'{key} = {py val}'`, appending the assignment if the key is missing. Because the modified configuration module is subsequently reloaded using `importlib.reload()`, a code-generation boundary is created. This allows specially crafted configuration keys to alter the Python source structure, leading to the execution of attacker-controlled Python statements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Flowintel allows the `LOG FILE` configuration value to be modified via system settings without restricting it to the intended log directory. This allows an administrator to set `LOG FILE` to an arbitrary filesystem path. Because attackers can influence the content being logged, they can write controlled data into unintended files. This can lead to remote code execution through an exploitation chain where an attacker injects a template into a file and abuses the application rendering behavior. The fix involves the `validate log file name()` function to reject absolute paths, traversal, Windows paths, null bytes, and directory components, while centralizing path construction through `resolve log file path()`. **Recommendations** Update Flowintel to a version where `LOG FILE` is removed from web-editable settings and path validation is implemented. As a temporary mitigation, restrict administrative access to system settings to prevent the modification of the `LOG FILE` configuration value.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Stored Cross-Site Scripting (XSS) occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edit notes can store a crafted Mermaid payload that executes JavaScript in the browser of any user who views the affected case note. **Recommendations** Update Flowintel to a version where Mermaid detection and HTML escaping are implemented for token content and wrapping logic is moved earlier in page initialization.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Stored Cross-Site Scripting (XSS) occurs because calendar event titles are rendered using `innerHTML`. Since these titles are derived from case titles, a user with permissions to create or modify a case title can inject HTML or script-capable content. This content is subsequently executed by the browser when another user views the calendar. The issue involves the use of `innerHTML` to assign the `arg.event.title` variable. **Recommendations** For versions 3.3.0 and later, update the software to replace the use of `innerHTML` with `textContent` when rendering the `arg.event.title` variable and the static download icon.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and earlier **Description** An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case identifier. Consequently, an authenticated user with editor-level access to one case could substitute a task ID from a different case to perform unauthorized operations. This affects endpoints related to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, and external-reference. Additionally, the system did not verify if a `note id` belonged to the current task during retrieval or export operations. **Recommendations** Update to a version later than 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** An authorization flaw exists in the administrative user-edit API. While the system prevents organization administrators from editing users in different organizations, it fails to restrict them from modifying full administrator accounts within their own organization. This allows an organization administrator to change the password of a full administrator, leading to privilege escalation. The issue is addressed by implementing a privilege boundary check using the `is admin()` function to block these modifications. **Recommendations** Update Flowintel to a version where the `is admin()` boundary check is implemented in the user-edit API to prevent organization administrators from modifying full administrator accounts.

**Name of the Vulnerable Software and Affected Versions** Flowintel version 3.3.0 **Description** An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a `user id` parameter to identify the user whose assignments are retrieved, but it lacks proper role-based access control. This allows a lower-privileged authenticated user to access assignment information of other users by providing their respective identifiers. **Recommendations** Update Flowintel version 3.3.0 to a version where the '/my assignment/user' endpoint is restricted to administrators or organization administrators.

**Name of the Vulnerable Software and Affected Versions** FlowIntel (affected versions not specified) **Description** FlowIntel contains a stored cross-site scripting issue where multiple user-controlled or administrator-controlled fields are rendered inside DOM elements compiled by Vue. While standard HTML escaping is present, it fails to prevent the injection of Vue interpolation expressions using `[[ ... ]]` delimiters. An authenticated attacker can store a malicious Vue expression in fields such as case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names. When another user views the affected component, Vue evaluates the expression, allowing arbitrary JavaScript execution under the FlowIntel origin. This can lead to unauthorized information exposure, actions performed using the victim's session, or modification of application data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlowIntel versions prior to 3.3.1 **Description** An issue exists in the external reference URL probe functionality within `app/case/task.py`. An attacker can submit an external reference URL to force the application server to issue an HTTP HEAD request to a specified destination. Due to insufficient validation of the URL scheme and resolved destination address, this allows requests to loopback, link-local, private, reserved, or other restricted network resources. This may enable interaction with internal services or cloud metadata endpoints from the server's network context. This is a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. **Recommendations** Update to a version later than 3.3.0.