CVE-2020-15711: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2020-07-14T13:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/Controller/AppController.php, app/View/Elements/global_menu.ctp, app/View/Layouts/default.ctp, app/webroot/js/misp.js
Commit date: 2020-07-13 12:19:11 +0200
Commit message: fix: [security] setting a favourite homepage was not CSRF protected

- a user could be lured into setting a MISP home-page outside of the MISP baseurl
- switched the endpoint to be CSRF protection enabled

- as discovered by Mislav Božičević <mislav.bozicevic@nn.cz>

Diff: diff --git a/app/Controller/AppController.php b/app/Controller/AppController.php
index 958eae3b1d3..e8f6003ff62 100755
--- a/app/Controller/AppController.php
+++ b/app/Controller/AppController.php
@@ -44,11 +44,11 @@ class AppController extends Controller
 
     public $debugMode = false;
 
     public $helpers = array('Utility', 'OrgImg', 'FontAwesome', 'UserName', 'DataPathCollector');
 
-    private $__queryVersion = '106';
+    private $__queryVersion = '107';
     public $pyMispVersion = '2.4.128';
     public $phpmin = '7.2';
     public $phprec = '7.4';
     public $pythonmin = '3.6';
     public $pythonrec = '3.7';
diff --git a/app/View/Elements/global_menu.ctp b/app/View/Elements/global_menu.ctp
index 6bb141a74c6..5cfa1ebb55e 100755
--- a/app/View/Elements/global_menu.ctp
+++ b/app/View/Elements/global_menu.ctp
@@ -411,12 +411,13 @@
         $menu_right = array(
             array(
                 'type' => 'root',
                 'url' => '#',
                 'html' => sprintf(
-                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP"></span>',
-                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : ''
+                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP" data-current-page="%s"></span>',
+                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : '',
+                    $this->here
                 )
             ),
             array(
                 'type' => 'root',
                 'url' =>empty($homepage['path']) ? $baseurl : $baseurl . h($homepage['path']),
diff --git a/app/View/Layouts/default.ctp b/app/View/Layouts/default.ctp
index 9f5b7d16945..57f391f9a54 100644
--- a/app/View/Layouts/default.ctp
+++ b/app/View/Layouts/default.ctp
@@ -86,10 +86,11 @@
         <div id="ajax_success" class="ajax_result ajax_success"></div>
     </div>
     <div id = "ajax_fail_container" class="ajax_container">
         <div id="ajax_fail" class="ajax_result ajax_fail"></div>
     </div>
+    <div id = "ajax_hidden_container" class="hidden"></div>
     <div class="loading">
         <div class="spinner"></div>
         <div class="loadingText"><?php echo __('Loading');?></div>
     </div>
     <script type="text/javascript">
diff --git a/app/webroot/js/misp.js b/app/webroot/js/misp.js
index ffd2be285f8..96949228cdf 100644
--- a/app/webroot/js/misp.js
+++ b/app/webroot/js/misp.js
@@ -5020,19 +5020,27 @@ function resetDashboardGrid(grid) {
     });
 }
 
 function setHomePage() {
     $.ajax({
-        type: 'POST',
+        type: 'GET',
         url: baseurl + '/userSettings/setHomePage',
-        data: {
-            path: window.location.pathname
-        },
         success:function (data, textStatus) {
-            showMessage('success', 'Homepage set.');
-            $('#setHomePage').addClass('orange');
-        },
+            $('#ajax_hidden_container').html(data);
+            var currentPage = $('#setHomePage').data('current-page');
+            $('#UserSettingPath').val(currentPage);
+            $.ajax({
+                type: 'POST',
+                url: baseurl + '/userSettings/setHomePage',
+                data: $('#UserSettingSetHomePageForm').serialize(),
+                success:function (data, textStatus) {
+                    showMessage('success', 'Homepage set.');
+                    $('#setHomePage').addClass('orange');
+                },
+            });
+
+        }
     });
 }
 
 function changeLocationFromIndexDblclick(row_index) {
     var href = $('table tr[data-row-id=\"' + row_index + '\"] .dblclickActionElement').attr('href')

Vulnerable code:     private $__queryVersion = '106';
                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP"></span>',
                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : ''
        type: 'POST',
        data: {
            path: window.location.pathname
        },
            showMessage('success', 'Homepage set.');
            $('#setHomePage').addClass('orange');
        },
Fixed code:     private $__queryVersion = '107';
                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP" data-current-page="%s"></span>',
                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : '',
                    $this->here
    <div id = "ajax_hidden_container" class="hidden"></div>
        type: 'GET',
            $('#ajax_hidden_container').html(data);
            var currentPage = $('#setHomePage').data('current-page');
            $('#UserSettingPath').val(currentPage);
            $.ajax({
                type: 'POST',
                url: baseurl + '/userSettings/setHomePage',
                data: $('#UserSettingSetHomePageForm').serialize(),
                success:function (data, textStatus) {
                    showMessage('success', 'Homepage set.');
                    $('#setHomePage').addClass('orange');
                },
            });

        }