Peter James

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue exists in the sharing group quick-edit functionality. The `addOrg`, `removeOrg`, `addServer`, and `removeServer` actions utilize the ` initialiseSGQuickEdit()` helper, where the HTTP method validation meant to restrict operations to POST requests was disabled. Consequently, these state-changing actions can be triggered via GET requests. An attacker could trick an authenticated user with sufficient privileges into clicking a malicious link, allowing the attacker to modify sharing group memberships by adding or removing organizations or servers. This could lead to unauthorized access to distributed information or the disruption of legitimate information sharing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue occurs because the system disables form-security and CSRF protections if a request is identified as REST traffic. This detection can be manipulated by an attacker using the HTTP Accept header (e.g., `Accept: application/json`), which can be sent from a cross-origin page without a CORS preflight. Consequently, the system may treat a request from a malicious website as REST traffic and bypass security validations while using the victim's authenticated browser session. An attacker could trick an authenticated user into visiting a malicious page to execute unauthorized state-changing requests to susceptible endpoints, potentially leading to the unauthorized modification, creation, publication, or removal of data. The issue stems from the ` isRest()` function granting security exemptions based on request type rather than the authentication mechanism. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An issue in the email-based one-time password (OTP) authentication flow allows an attacker to perform an unrestricted number of OTP verification attempts. The `email otp()` endpoint lacks brute-force protection when validating submitted OTP values. An attacker who has passed the primary authentication stage can repeatedly submit candidate OTP values while the same OTP remains valid, increasing the likelihood of guessing the code and bypassing the second authentication factor to gain unauthorized account access. This is further complicated because the OTP is linked to the user instead of a specific login session, enabling multiple concurrent sessions to guess the same valid OTP. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** A persistent unsafe URL injection exists in the ButtonWidget configuration of the dashboard. The issue occurs because dashboard widget URLs were validated only during rendering and not when the configuration was saved. This allows an authenticated user with permissions to modify dashboard settings to persist arbitrary URL values, including those using the `javascript:` scheme. If these values reach a rendering or navigation path that lacks runtime validation, it could lead to client-side script execution within the security context of the MISP session. This could enable an attacker to perform actions using the privileges of the affected user or access session-specific information. This flaw is characterized as a persistence-layer validation gap and a defense-in-depth weakness. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authenticated user with permissions to create or modify event templates can bypass validation of the template definition field. The `EventTemplate::beforeValidate()` method only performs semantic validation if the definition is an array; if a pre-encoded string containing malformed JSON or an unexpected data type is provided, it bypasses `validateDefinition()` and is stored in the database. Subsequently, the `EventTemplate::afterFind()` method uses `JsonTool::decode()` to retrieve the definition without handling decoding failures. This can trigger exceptions and cause HTTP 500 errors for all authenticated users accessing the event template index or other functionality relying on `EventTemplate` queries, resulting in a persistent denial of service. Additionally, JSON representing an unexpected type may lead to invalid data reaching downstream consumers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** A session fixation issue exists in the CustomAuth authentication flow. The system stores the authenticated user identity in the existing session without rotating the session identifier. This allows an attacker to use a pre-known session identifier to hijack a victim's authenticated session and gain their account privileges. The flaw occurs because the ` customAuthentication()` function writes the user into the CakePHP session while the `Session->renew()` call is disabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause an authenticated MISP user with sufficient privileges to invoke the endpoint simply by causing their browser to load a crafted URL, for example through an embedded image or other automatically requested resource. Successful exploitation triggers the deletion of published empty events. The deletion is particularly significant because the operation uses skipBlocklist, meaning the removed events do not leave blocklist entries that could prevent or track their subsequent synchronization. This can result in unintended and potentially irreversible deletion of MISP event records without explicit user interaction. The vulnerability was addressed by restricting cullEmptyEvents to HTTP POST requests, ensuring that CakePHP's normal CSRF protections are applied to the operation.