Jeroen Pinoy

A reflected cross-site scripting (XSS) issue exists in the workflow module interface. The application renders parameter names returned by the misp-modules service as raw HTML form labels without output encoding. An attacker capable of influencing these parameter names can inject arbitrary HTML or JavaScript. This script executes within the browser session of an authenticated user, potentially leading to session token theft, interface manipulation, or unauthorized actions.

A flaw in the server settings lookup mechanism allows authenticated users to retrieve sensitive configuration data that should be redacted. The settings lookup function resolves dotted setting names to nodes in a configuration tree; however, providing a branch name (such as Security, MISP, or Plugin) instead of a specific leaf setting causes the function to return the entire sub-tree. Since branch nodes lack a redaction flag, the redaction check in the settings retrieval endpoint is bypassed. This exposes sensitive information, including the security salt, Redis connection passwords, and plugin API keys. Additionally, an endpoint used to edit server settings similarly returns the entire configuration store when a branch name is resolved.

A cross-site scripting (XSS) issue exists in the TAXII object viewer. The application renders the JSON content of string properties directly into an HTML pre block without proper HTML-encoding when displaying a remote TAXII object. An attacker capable of influencing the content of a TAXII object, such as by publishing a malicious object to a TAXII server that the victim's instance subscribes to, can inject arbitrary HTML or JavaScript. This script executes within the context of the authenticated user's session, potentially leading to the theft of session tokens, API keys, or other sensitive data, and allowing actions to be performed on behalf of the user.

The ID Translator feature contains a cross-site scripting (XSS) flaw. When a user accesses the ID Translator page, the application retrieves event identifiers from linked remote servers. Because the application fails to properly encode the event ID returned by the remote server before rendering it in the HTML output, a compromised or malicious linked server can provide a crafted event ID containing arbitrary HTML or JavaScript. This allows the execution of scripts in the browser of an authenticated user, potentially leading to session hijacking or credential theft.

A stored cross-site scripting (XSS) issue exists in the index table rendering of the remote event preview. The count field template fails to apply HTML encoding to the field value, although it escapes the associated link URL. An attacker with permissions to create or modify events on a linked remote MISP server can craft an event identifier containing HTML or JavaScript markup. When a user on the local instance views the remote event preview index, the unescaped value is rendered in the browser, enabling arbitrary script execution. This can lead to session hijacking, data exfiltration, or unauthorized actions performed as the authenticated user.

A cross-site scripting (XSS) issue exists in the remote event preview page. When a linked remote server is configured, the event preview renders tag identifiers within an inline JavaScript onclick attribute. While the tag ID value is HTML-escaped, it is not sanitized for the JavaScript string context. This allows a malicious linked server to provide a tag ID containing characters, such as a single quote, that break the JavaScript string literal to inject arbitrary script. This can lead to arbitrary JavaScript execution in the browser session of an authenticated user who interacts with the affected tag element, potentially resulting in session hijacking, data exfiltration, or unauthorized actions.

Improper input validation exists in the decaying model import functionality. The import endpoint was designed to create a new decaying model restricted to the importing user's organization with the default flag disabled. However, the application only stripped top-level `id` and `uuid` fields and pinned `org id` and `default` on the outer array. An authenticated user with `perm decaying` permissions could provide a nested model key containing its own primary key, organization identifier, and default flag to bypass these restrictions during the save operation. This could allow a user to overwrite existing decaying models from other organizations, modify models flagged as organization defaults to affect scoring behavior, or reassign a model's organization to an arbitrary value.

A reflected cross-site scripting (XSS) issue exists in the analyst data notes panel. The `seed` path parameter, provided by the user via the URL, is passed directly into inline JavaScript within the HTML response without sanitization or type enforcement. An attacker can convince an authenticated user to visit a crafted URL, allowing the execution of arbitrary JavaScript in the victim's browser context. This could lead to the theft of session tokens, page manipulation, or unauthorized actions performed on behalf of the user.

An improper input validation issue exists in the ORM save path. When submitting data through endpoints such as attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, and user admin edit, the application sanitizes records by removing the primary key and pinning the `event id` or `object id` to the caller's context. However, the ORM `set()` method prioritizes a nested key matching the model alias, ignoring the outer scalar fields. An authenticated user with basic write permissions can embed a nested block under the model alias key to bypass sanitization, allowing them to use an attacker-chosen `id` and `event id`. This can lead to cross-tenant data integrity compromise, enabling the overwriting, re-parenting, or soft-deletion of rows belonging to other organizations or events, affecting entity types including Attribute, Object, EventReport, Sighting, AttributeTag, and ShadowAttribute.

A stored cross-site scripting (XSS) issue exists in the galaxy icon handling path. The `icon` field of a galaxy object is stored without server-side validation via the galaxy add, edit, and sync/import capture endpoints. This stored value is then directly concatenated into HTML markup by D3-based correlation graph rendering scripts in both the default and Overmind themes using the `.html()` method. A user with `perm galaxy editor` permissions can inject arbitrary HTML or JavaScript into the `icon` field, which executes in the browser session of any user viewing the correlation graph of an event containing a cluster from that galaxy. This can lead to session credential theft, data manipulation, or unauthorized actions performed on behalf of the victim.

Stored cross-site scripting (XSS) occurs because the source field of a Galaxy Cluster is rendered as a clickable hyperlink if the value passes PHP's `FILTER VALIDATE URL` validation. Since this validation accepts the `javascript:` URI scheme, a user with galaxy editor privileges can store a malicious script as the cluster source. When another user clicks the link, the script executes in their browser context, potentially leading to session hijacking, data exfiltration, or unauthorized actions.

A privilege escalation issue exists in the tag collection creation and editing functionality. The system accepts the full HTTP request payload and passes it to a bulk-association save operation, which writes both the intended tag collection record and any other associated model data included in the payload. An authenticated user with the `perm tag editor` permission can craft a request containing additional model data, such as User or Organisation records. Since the save operation processes all associated models indiscriminately, these injected records are written to the database, allowing the attacker to create or modify privileged accounts and escalate their privileges to site administrator.

A mass assignment issue exists in the event delegation feature. When a user with delegation permissions submits a request, the application validates the user against the event in the URL but persists the entire submitted record, including caller-supplied fields such as the primary key and `event id`. An authenticated attacker with the `perm delegate` permission can inject a primary key or `event id` into the delegation payload to retarget an existing delegation record to any event on the instance. This allows unauthorized read access to events belonging to other organizations. If the target organization accepts the delegation, event ownership is transferred and the original record is deleted. This requires the `MISP.delegation` server setting to be enabled.

The crawler splash domain page `showDomain.html` is susceptible to stored cross-site script injection (XSS). This occurs because user-supplied data from imported crawler captures—specifically `item IDs`, `URLs`, and screenshot file paths—is interpolated directly into inline JavaScript contexts within the HTML template. The issue manifests in an `onclick` attribute that embeds raw screenshot and URL values into a JavaScript function call, as well as an inline script block that assigns a screenshot value to a JavaScript variable without proper escaping. An attacker with a user-role API client can import malicious crawler captures containing JavaScript payloads. When a user views the affected domain page, the script executes in their browser context, which may lead to session hijacking, data exfiltration, or unauthorized actions.

The crawler task creation API 'api add crawler task' contains an insufficient authorization check when a user provides a cookiejar UUID for a one-shot or scheduled crawler task. The system fails to validate organizational boundaries or the requesting user's role. Specifically, if the cookiejar access level is not 0, no access check is performed; if it is 0, the system only compares the owning user ID to the requesting user ID. An authenticated user with the ability to create crawler tasks who knows or guesses a valid cookiejar UUID from another organization can force the crawler to use that organization's stored cookies, such as session tokens and authentication credentials, leading to the exfiltration of session data.

A stored cross-site scripting (XSS) issue exists in two Jinja2 templates used to render popovers for matched, tracked, or tagged content: `var/www/templates/chats explorer/block message.html` and `var/www/templates/objects/item/show item.html`. Dynamic values such as `icon color`, `icon style`, `icon glyph`, `subtype`, `identifier`, `name`, `description`, and `matched value` are inserted into the `data-content` HTML attribute of Bootstrap popover elements without proper output encoding. Since these popovers use `data-html="true"`, the browser interprets the content as HTML. An authenticated attacker capable of influencing this content can inject arbitrary HTML or JavaScript, which executes in the session of a victim viewing the popover, potentially leading to data exfiltration or unauthorized actions using the victim's privileges.

The tag selector component located at `var/www/static/js/tags.js` is susceptible to stored cross-site scripting (XSS). An authenticated user with permissions to create custom tags can embed HTML payloads containing JavaScript event handlers within a tag name. The issue occurs because the ` renderComboItems` function and the selected-tag rendering logic pass the `displayField` value directly to the jQuery `html` property, which inserts the string as raw HTML into the Document Object Model (DOM) instead of treating it as plain text. This allows arbitrary JavaScript execution in the browser of any authenticated user who views a page rendering the malicious tag, potentially leading to session hijacking, unauthorized data access, or form manipulation.

The username timeline feature is susceptible to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst hovers over a timeline entry, the application renders the stored username into the Document Object Model (DOM) using the D3 `html()` method in the tooltip. Because the `d.obj` variable is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers can execute arbitrary JavaScript in the analyst's browser. This issue resides in the client-side JavaScript file `var/www/static/js/d3/timeline basic.js`. Successful exploitation may result in session hijacking, data exfiltration, or unauthorized actions within the authenticated session.

The Onion module contains a flaw in its URL extraction logic due to a performance shortcut. The system validates .onion targets using only a length check of exactly 69 characters and a suffix check for ".onion", omitting proper hostname parsing or onion-domain validation. An unauthenticated attacker can embed a crafted URL containing an IP address or a non-onion hostname with a path ending in ".onion" into content crawled by the framework. This allows the injection of arbitrary non-onion targets into the crawler's task queue, potentially directing the framework toward unintended network resources and compromising the integrity of target selection.

The Overmind event view enriches events with the most recent attached report for preview. The enrichment logic retrieves reports using only the event ID, failing to apply the report's specific distribution or Access Control List (ACL) constraints. Since reports can have more restrictive distribution settings than their parent events, an authenticated user with read access to an event can view reports that explicitly exclude them. Furthermore, the query fails to filter out soft-deleted reports, enabling the retrieval of reports that were administratively removed, leading to unauthorized disclosure of threat-intelligence content.