CVE-2024-29859

MISP's UiBeta collection view performs a secondary query of member events by UUID without applying the caller's ACL. An authenticated user with view access to a collection can retrieve full details of events they are not permitted to read, including identifiers, info, dates, timestamps, creator org, tags, and galaxy clusters.

A vulnerability in MISP allows an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. By supplying a pre-encoded string instead of an array structure, an invalid definition can be persistently stored. On retrieval, invalid JSON triggers an exception, causing HTTP 500 errors in event template functionality.

MISP contains a session fixation vulnerability in the CustomAuth authentication flow. After successful authentication via CustomAuth, MISP stores the authenticated user identity in the existing session without first rotating the session identifier. An attacker who knows the victim's session identifier before authentication can later reuse it to access the victim's authenticated session.

A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection, enabling repeated guessing of OTP and potential bypass of the additional authentication factor.

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. As a result, an authenticated user could receive correlation results referring to attributes or events that the user was not authorized to access.

An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.

In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.

MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.