CVE-2024-29858: Insufficient Information (NVD-CWE-noinfo)
value: In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T04:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/OrganisationsController.php
Commit date: 2024-03-05 14:48:57 +0100
Commit message: fix: [security] properly check for valid logo upload

- as kindly reported by Rémi Matasse and Raphael Lob from Synacktiv (https://www.synacktiv.com)

Diff: diff --git a/app/Controller/OrganisationsController.php b/app/Controller/OrganisationsController.php
index fd0f9893197..90eccf6d971 100644
--- a/app/Controller/OrganisationsController.php
+++ b/app/Controller/OrganisationsController.php
@@ -488,12 +488,18 @@ class OrganisationsController extends AppController
 
             if ($extension !== 'svg' && $extension !== 'png') {
                 $this->Flash->error(__('Invalid file extension, Only PNG and SVG images are allowed.'));
                 return false;
             }
-
-            $imgMime = mime_content_type($logo['tmp_name']);
+            $matches = null;
+            $tmp_name = $logo['tmp_name'];
+            if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($logo['tmp_name'])) {
+                $tmp_name = $matches[0][0];
+                $imgMime = mime_content_type($tmp_name);
+            } else {
+                throw new NotFoundException(__('Invalid file.'));    
+            }
             if ($extension === 'png' && (function_exists('exif_imagetype') && !exif_imagetype($logo['tmp_name']))) {
                 $this->Flash->error(__('This is not a valid PNG image.'));
                 return false;
             }
 
@@ -505,12 +511,12 @@ class OrganisationsController extends AppController
             if ($extension === 'svg' && !Configure::read('Security.enable_svg_logos')) {
                 $this->Flash->error(__('Invalid file extension, SVG images are not allowed.'));
                 return false;
             }
 
-            if (!empty($logo['tmp_name']) && is_uploaded_file($logo['tmp_name'])) {
-                return move_uploaded_file($logo['tmp_name'], APP . 'files/img/orgs/' . $filename);
+            if (!empty($tmp_name) && is_uploaded_file($tmp_name)) {
+                return move_uploaded_file($tmp_name, APP . 'files/img/orgs/' . $filename);
             }
         }
 
         return false;
     }

Vulnerable code: 
            $imgMime = mime_content_type($logo['tmp_name']);
            if (!empty($logo['tmp_name']) && is_uploaded_file($logo['tmp_name'])) {
                return move_uploaded_file($logo['tmp_name'], APP . 'files/img/orgs/' . $filename);
Fixed code:             $matches = null;
            $tmp_name = $logo['tmp_name'];
            if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($logo['tmp_name'])) {
                $tmp_name = $matches[0][0];
                $imgMime = mime_content_type($tmp_name);
            } else {
                throw new NotFoundException(__('Invalid file.'));    
            }
            if (!empty($tmp_name) && is_uploaded_file($tmp_name)) {
                return move_uploaded_file($tmp_name, APP . 'files/img/orgs/' . $filename);