Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-10254: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-03-28T15:29Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Layouts/default.ctp
Commit date: 2019-03-28 12:05:21 +0100
Commit message: fix: [security] Fix to a reflected XSS in the default layout template

- as reported by Tuscany Internet eXchange | Misp Team | TIX CyberSecurity

Diff: diff --git a/app/View/Layouts/default.ctp b/app/View/Layouts/default.ctp
index 9b720d2958..93139d9c03 100644
--- a/app/View/Layouts/default.ctp
+++ b/app/View/Layouts/default.ctp
@@ -99,13 +99,13 @@
     ?>
         var tabIsActive = true;
         var baseurl = '<?php echo $baseurl; ?>';
         var here = '<?php
                 if (substr($this->params['action'], 0, 6) === 'admin_') {
-                    echo $baseurl . '/admin/' . $this->params['controller'] . '/' . substr($this->params['action'], 6);
+                    echo $baseurl . '/admin/' . h($this->params['controller']) . '/' . h(substr($this->params['action'], 6));
                 } else {
-                    echo $baseurl . '/' . $this->params['controller'] . '/' . $this->params['action'];
+                    echo $baseurl . '/' . h($this->params['controller']) . '/' . h($this->params['action']);
                 }
             ?>';
         $(document).ready(function(){
             $(window).blur(function() {
                 tabIsActive = false;

Vulnerable code:                     echo $baseurl . '/admin/' . $this->params['controller'] . '/' . substr($this->params['action'], 6);
                    echo $baseurl . '/' . $this->params['controller'] . '/' . $this->params['action'];
Fixed code:                     echo $baseurl . '/admin/' . h($this->params['controller']) . '/' . h(substr($this->params['action'], 6));
                    echo $baseurl . '/' . h($this->params['controller']) . '/' . h($this->params['action']);
CVE-2019-11814: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-05-08T13:29Z
Repository: https://github.com/MISP/MISP
Language: JavaScript
Files changed: app/webroot/js/misp.js
Commit date: 2019-05-07 09:01:05 +0200
Commit message: fix: [security] Fix persistent xss due to invalid sanitisation of image names in titles

- triggered by expanding a screenshot

- as reported by João Lucas Melo Brasio from Elytron Security S.A. (https://elytronsecurity.com)

Diff: diff --git a/app/webroot/js/misp.js b/app/webroot/js/misp.js
index c965a31fd9..be847e7b45 100644
--- a/app/webroot/js/misp.js
+++ b/app/webroot/js/misp.js
@@ -95,11 +95,13 @@ function genericPopup(url, popupTarget, callback) {
 
 function screenshotPopup(url, title) {
     if (!url.startsWith('data:image/')) {
         url = url.slice(0, -1);
     }
-    popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>'
+    popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>';
+    url = $('<div>').text(url).html();
+    title = $('<div>').text(title).html();
     popupHtml += '<img class="screenshot_box-content hidden" src="' + url + '" id="screenshot-image" title="' + title + '" alt="' + title + '" onload="$(this).show(); $(this).parent().find(\'.fa-spinner\').remove();"/>';
     popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>';
     if (!url.startsWith('data:image/')) {
         popupHtml += '<a class="close-icon useCursorPointer fa fa-expand" style="right: 20px; background: black; color: white; text-decoration: none;" target="_blank" href="' + url + '" ></a>';
     }

Vulnerable code:     popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>'
Fixed code:     popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>';
    url = $('<div>').text(url).html();
    title = $('<div>').text(title).html();
CVE-2019-12868: Deserialization of Untrusted Data (CWE-502)
value: app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.2
Published: 2019-06-18T00:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Server.php
Commit date: 2019-06-16 19:11:35 +0200
Commit message: fix: [security] Fixed an RCE vulnerability with user controled entries being fed to file_exists

- phar protocol paths for php file instructions can lead to RCE via meta-data deserialization
- mitigated by the functionalities enabling this being only accessible to site admins

- Reported by Dawid Czarnecki

Diff: diff --git a/app/Model/Server.php b/app/Model/Server.php
index 072505b1ec..ffffea83d3 100644
--- a/app/Model/Server.php
+++ b/app/Model/Server.php
@@ -3074,10 +3074,13 @@ class Server extends AppModel
         return $this->testForBinExec($value);
     }
 
     public function testForBinExec($value)
     {
+        if (substr($value, 0, 7) === "phar://") {
+            return 'Phar protocol not allowed.';
+        }
         $finfo = finfo_open(FILEINFO_MIME_TYPE);
         if ($value === '') {
             return true;
         }
         if (is_executable($value)) {
@@ -3092,10 +3095,13 @@ class Server extends AppModel
         }
     }
 
     public function testForWritableDir($value)
     {
+        if (substr($value, 0, 7) === "phar://") {
+            return 'Phar protocol not allowed.';
+        }
         if (!is_dir($value)) {
             return 'Not a valid directory.';
         }
         if (!is_writeable($value)) {
             return 'Not a writable directory.';

Fixed code:         if (substr($value, 0, 7) === "phar://") {
            return 'Phar protocol not allowed.';
        }
        if (substr($value, 0, 7) === "phar://") {
            return 'Phar protocol not allowed.';
        }
CVE-2019-14286: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-07-27T18:15Z
Repository: https://github.com/MISP/MISP
Language: JavaScript
Files changed: app/webroot/js/event-graph.js
Commit date: 2019-07-27 10:41:48 +0200
Commit message: fix: [security] Fix to stored XSS

- as reported by David Heise

Diff: diff --git a/app/webroot/js/event-graph.js b/app/webroot/js/event-graph.js
index 19586d12dd..80228639c6 100644
--- a/app/webroot/js/event-graph.js
+++ b/app/webroot/js/event-graph.js
@@ -2181,11 +2181,14 @@ $(document).on("keyup", function(evt) {
 
 eventGraph.update_scope();
 dataHandler.fetch_data_and_update(true, function() {
     var $select = $('#network-typeahead');
     dataHandler.get_typeaheadData_search().forEach(function(element) {
-        $select.append('<option value="' + element + '">' + element + '</option>');
+        var $option = $('<option></option>');
+        $option.text(element);
+        $option.attr('value', $option.text());
+        $select.append($option);
     });
     $('#network-typeahead').chosen(chosen_options).on('change', function(evt, params) {
         var value = params.selected;
         var nodeID = dataHandler.mapping_value_to_nodeID.get(value);
         // in case we searched for an object relation

Vulnerable code:         $select.append('<option value="' + element + '">' + element + '</option>');
Fixed code:         var $option = $('<option></option>');
        $option.text(element);
        $option.attr('value', $option.text());
        $select.append($option);
CVE-2020-10246: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-03-09T19:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Users/statistics_orgs.ctp
Commit date: 2020-03-06 15:44:58 +0100
Commit message: fix: [security] Fix reflected xss via unsanitized URL parameters

- As reported by an external pentest company on behalf of the Centre for Cyber security Belgium (CCB)

Diff: diff --git a/app/View/Users/statistics_orgs.ctp b/app/View/Users/statistics_orgs.ctp
index 3bbf4c836ff..6f22950ea2d 100644
--- a/app/View/Users/statistics_orgs.ctp
+++ b/app/View/Users/statistics_orgs.ctp
@@ -10,11 +10,13 @@
         $types = array(
                 'local' => array('selected' => false, 'text' => __('Local organisations')),
                 'external' => array('selected' => false, 'text' => __('Known remote organisations')),
                 'all' => array('selected' => false, 'text' => __('All organisations'))
         );
-        $types[$scope]['selected'] = true;
+        if (isset($types[$scope])) {
+            $types[$scope]['selected'] = true;
+        }
     ?>
     <h4><?php echo __('Organisation list');?></h4>
     <p><?php echo __('Quick overview over the organisations residing on or known by this instance.');?></p>
     <div class="tabMenuFixedContainer" style="display:inline-block;">
             <?php

Vulnerable code:         $types[$scope]['selected'] = true;
Fixed code:         if (isset($types[$scope])) {
            $types[$scope]['selected'] = true;
        }
CVE-2020-13153: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-05-18T22:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Events/resolved_attributes.ctp
Commit date: 2020-05-18 12:38:51 +0200
Commit message: fix: [security] xss in the resolved attributes view

- thanks to Jakub Onderka for reporting it

Diff: diff --git a/app/View/Events/resolved_attributes.ctp b/app/View/Events/resolved_attributes.ctp
index 0bfbc61d902..44b3354fca7 100644
--- a/app/View/Events/resolved_attributes.ctp
+++ b/app/View/Events/resolved_attributes.ctp
@@ -97,11 +97,11 @@
                             'Value' => $relation['Attribute']['value'],
                             'Comment' => $relation['Attribute']['comment'],
                         );
                         $popoverHTML = '';
                         foreach ($popover as $key => $popoverElement) {
-                            $popoverHTML .= '<span class=\'bold\'>' . $key . '</span>: <span class=\'blue bold\'>' . $popoverElement . '</span><br />';
+                            $popoverHTML .= '<span class=\'bold\'>' . $key . '</span>: <span class=\'blue bold\'>' . h($popoverElement) . '</span><br />';
                         }
                 ?>
                         <a href="<?php echo $baseurl; ?>/events/view/<?php echo h($relation['Event']['id']);?>" data-toggle="popover" title="Attribute details" data-content="<?php echo h($popoverHTML); ?>" data-trigger="hover"><?php echo h($relation['Event']['id']);?></a>
                 <?php
                     endforeach;

Vulnerable code:                             $popoverHTML .= '<span class=\'bold\'>' . $key . '</span>: <span class=\'blue bold\'>' . $popoverElement . '</span><br />';
Fixed code:                             $popoverHTML .= '<span class=\'bold\'>' . $key . '</span>: <span class=\'blue bold\'>' . h($popoverElement) . '</span><br />';
CVE-2020-15412: Missing Authorization (CWE-862)
value: An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2020-06-30T14:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/EventsController.php
Commit date: 2020-06-30 09:01:55 +0200
Commit message: fix: [security] Check event ACL before allowing user to send event contact form

Diff: diff --git a/app/Controller/EventsController.php b/app/Controller/EventsController.php
index d6dd853ebaa..833e573900f 100644
--- a/app/Controller/EventsController.php
+++ b/app/Controller/EventsController.php
@@ -1,9 +1,12 @@
 <?php
 App::uses('AppController', 'Controller');
 App::uses('Xml', 'Utility');
 
+/**
+ * @property Event $Event
+ */
 class EventsController extends AppController
 {
     public $components = array(
             'Security',
             'Email',
@@ -2790,13 +2793,12 @@ class EventsController extends AppController
 
     // Send out an contact email to the person who posted the event.
     // Users with a GnuPG key will get the mail encrypted, other users will get the mail unencrypted
     public function contact($id = null)
     {
-        $id = $this->Toolbox->findIdByUuid($this->Event, $id);
-        $this->Event->id = $id;
-        if (!$this->Event->exists()) {
+        $events = $this->Event->fetchEvent($this->Auth->user(), array('eventid' => $id));
+        if (empty($events)) {
             throw new NotFoundException(__('Invalid event'));
         }
         // User has filled in his contact form, send out the email.
         if ($this->request->is('post') || $this->request->is('put')) {
             if (!isset($this->request->data['Event'])) {
@@ -2842,11 +2844,11 @@ class EventsController extends AppController
                 }
             }
         }
         // User didn't see the contact form yet. Present it to him.
         if (empty($this->data)) {
-            $this->data = $this->Event->read(null, $id);
+            $this->data = $events[0];
         }
     }
 
     public function automation($legacy = false)
     {

Vulnerable code:         $id = $this->Toolbox->findIdByUuid($this->Event, $id);
        $this->Event->id = $id;
        if (!$this->Event->exists()) {
            $this->data = $this->Event->read(null, $id);
Fixed code: /**
 * @property Event $Event
 */
        $events = $this->Event->fetchEvent($this->Auth->user(), array('eventid' => $id));
        if (empty($events)) {
            $this->data = $events[0];
CVE-2020-25766: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-09-18T18:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Users/login.ctp
Commit date: 2020-09-15 11:55:50 +0200
Commit message: fix: [users] Avoid POSTing forms not linked to the login page resulting in unwanted actions

- As reported by Michael Kerscher

Diff: diff --git a/app/View/Users/login.ctp b/app/View/Users/login.ctp
index 6c1dc862f39..4941eed3025 100644
--- a/app/View/Users/login.ctp
+++ b/app/View/Users/login.ctp
@@ -79,11 +79,14 @@ function submitLoginForm() {
     var password = $form.find('#UserPassword').val()
     if (!$form[0].checkValidity()) {
         $form[0].reportValidity()
     } else {
         fetchFormDataAjax(url, function(html) {
-            var formHTML = $(html).find('form')
+            var formHTML = $(html).find('form#UserLoginForm')
+            if (!formHTML.length) {
+                window.location = baseurl + '/users/login'
+            }
             $('body').append($('<div id="temp" style="display: none"/>').append(formHTML))
             var $tmpForm = $('#temp form')
             $tmpForm.find('#UserEmail').val(email)
             $tmpForm.find('#UserPassword').val(password)
             $tmpForm.submit()

Vulnerable code:             var formHTML = $(html).find('form')
Fixed code:             var formHTML = $(html).find('form#UserLoginForm')
            if (!formHTML.length) {
                window.location = baseurl + '/users/login'
            }
CVE-2020-29572: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-12-06T00:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
Commit date: 2020-12-04 16:20:02 +0100
Commit message: fix: [security] XSS in authkey comment field

Diff: diff --git a/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp b/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
index 748d59c778f..6f7a8cb1218 100644
--- a/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
+++ b/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
@@ -1,11 +1,11 @@
 <?php
 if (!empty($field['raw'])) {
     $string = $field['raw'];
 } else {
     $value = Hash::extract($data, $field['path']);
-    $string = empty($value[0]) ? '' : $value[0];
+    $string = empty($value[0]) ? '' : h($value[0]);
 }
 if (!empty($field['url'])) {
     if (!empty($field['url_vars'])) {
         if (!is_array($field['url_vars'])) {
             $field['url_vars'] = [$field['url_vars']];

Vulnerable code:     $string = empty($value[0]) ? '' : $value[0];
Fixed code:     $string = empty($value[0]) ? '' : h($value[0]);
CVE-2020-8890: Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
value: An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
CWE description: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
CVSS v3 base score: 5.9
Published: 2020-02-12T00:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Bruteforce.php
Commit date: 2020-02-08 09:35:37 +0100
Commit message: fix: [security] brutefoce protection rules tightened

- as reported by Dawid Czarnecki

Diff: diff --git a/app/Model/Bruteforce.php b/app/Model/Bruteforce.php
index 98b891f4b7a..c1e8356f7e1 100644
--- a/app/Model/Bruteforce.php
+++ b/app/Model/Bruteforce.php
@@ -47,15 +47,18 @@ class Bruteforce extends AppModel
     public function isBlacklisted($ip, $username)
     {
         // first remove old expired rows
         $this->clean();
         // count
-        $params = array('conditions' => array(
-                        'Bruteforce.ip' => $ip,
-                        'Bruteforce.username' => $username),);
+        $params = array(
+            'conditions' => array(
+            'Bruteforce.ip' => $ip,
+            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
+        );
         $count = $this->find('count', $params);
-        if ($count >= Configure::read('SecureAuth.amount')) {
+        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
+        if ($count >= $amount) {
             return true;
         } else {
             return false;
         }
     }

Vulnerable code:         $params = array('conditions' => array(
                        'Bruteforce.ip' => $ip,
                        'Bruteforce.username' => $username),);
        if ($count >= Configure::read('SecureAuth.amount')) {
Fixed code:         $params = array(
            'conditions' => array(
            'Bruteforce.ip' => $ip,
            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
        );
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        if ($count >= $amount) {
CVE-2020-8891: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.9
Published: 2020-02-12T00:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Bruteforce.php
Commit date: 2020-02-08 09:35:37 +0100
Commit message: fix: [security] brutefoce protection rules tightened

- as reported by Dawid Czarnecki

Diff: diff --git a/app/Model/Bruteforce.php b/app/Model/Bruteforce.php
index 98b891f4b7a..c1e8356f7e1 100644
--- a/app/Model/Bruteforce.php
+++ b/app/Model/Bruteforce.php
@@ -47,15 +47,18 @@ class Bruteforce extends AppModel
     public function isBlacklisted($ip, $username)
     {
         // first remove old expired rows
         $this->clean();
         // count
-        $params = array('conditions' => array(
-                        'Bruteforce.ip' => $ip,
-                        'Bruteforce.username' => $username),);
+        $params = array(
+            'conditions' => array(
+            'Bruteforce.ip' => $ip,
+            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
+        );
         $count = $this->find('count', $params);
-        if ($count >= Configure::read('SecureAuth.amount')) {
+        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
+        if ($count >= $amount) {
             return true;
         } else {
             return false;
         }
     }

Vulnerable code:         $params = array('conditions' => array(
                        'Bruteforce.ip' => $ip,
                        'Bruteforce.username' => $username),);
        if ($count >= Configure::read('SecureAuth.amount')) {
Fixed code:         $params = array(
            'conditions' => array(
            'Bruteforce.ip' => $ip,
            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
        );
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        if ($count >= $amount) {
CVE-2020-8892: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.1
Published: 2020-02-12T00:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Bruteforce.php
Commit date: 2020-02-08 09:35:37 +0100
Commit message: fix: [security] brutefoce protection rules tightened

- as reported by Dawid Czarnecki

Diff: diff --git a/app/Model/Bruteforce.php b/app/Model/Bruteforce.php
index 98b891f4b7a..c1e8356f7e1 100644
--- a/app/Model/Bruteforce.php
+++ b/app/Model/Bruteforce.php
@@ -47,15 +47,18 @@ class Bruteforce extends AppModel
     public function isBlacklisted($ip, $username)
     {
         // first remove old expired rows
         $this->clean();
         // count
-        $params = array('conditions' => array(
-                        'Bruteforce.ip' => $ip,
-                        'Bruteforce.username' => $username),);
+        $params = array(
+            'conditions' => array(
+            'Bruteforce.ip' => $ip,
+            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
+        );
         $count = $this->find('count', $params);
-        if ($count >= Configure::read('SecureAuth.amount')) {
+        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
+        if ($count >= $amount) {
             return true;
         } else {
             return false;
         }
     }

Vulnerable code:         $params = array('conditions' => array(
                        'Bruteforce.ip' => $ip,
                        'Bruteforce.username' => $username),);
        if ($count >= Configure::read('SecureAuth.amount')) {
Fixed code:         $params = array(
            'conditions' => array(
            'Bruteforce.ip' => $ip,
            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
        );
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        if ($count >= $amount) {
CVE-2020-8893: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-02-12T00:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Galaxies/view.ctp
Commit date: 2020-02-10 14:35:09 +0100
Commit message: fix: [security] Correctly sanitize search string in Galaxy view

- As reported by Dawid Czarnecki

Diff: diff --git a/app/View/Galaxies/view.ctp b/app/View/Galaxies/view.ctp
index bd978db792e..c9c67fb75f1 100644
--- a/app/View/Galaxies/view.ctp
+++ b/app/View/Galaxies/view.ctp
@@ -39,11 +39,11 @@
 $(document).ready(function () {
     <?php
     $uri = "/galaxy_clusters/index/" . $galaxy['Galaxy']['id'];
     if (isset($passedArgsArray)) $uri .= '/searchall:' . $passedArgsArray['all'];
     ?>
-    $.get("<?php echo $uri;?>", function(data) {
+    $.get("<?php echo h($uri);?>", function(data) {
         $("#clusters_div").html(data);
     });
 
     var $kco = $('#killChainOrder');
     var j = syntaxHighlightJson($kco.text(), 8)

Vulnerable code:     $.get("<?php echo $uri;?>", function(data) {
Fixed code:     $.get("<?php echo h($uri);?>", function(data) {
CVE-2021-25323: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 9.1
Published: 2021-01-19T16:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Config/config.default.php
Commit date: 2021-01-19 14:01:36 +0100
Commit message: fix: [security] Require password confirmations by default

- the setting is optional, but the default should be that it's required unless disabled

- As reported by Patrix Kontura from ESET

Diff: diff --git a/app/Config/config.default.php b/app/Config/config.default.php
index c1f944dba78..ab368842749 100644
--- a/app/Config/config.default.php
+++ b/app/Config/config.default.php
@@ -4,10 +4,11 @@ $config = array(
 	'Security'         =>
 		array(
 			'level'      => 'medium',
 			'salt'       => '',
 			'cipherSeed' => '',
+            'require_password_confirmation' => true
 			//'auth'=>array('CertAuth.Certificate'), // additional authentication methods
 			//'auth'=>array('ShibbAuth.ApacheShibb'),
 		),
 	'MISP'             =>
 		array(

Fixed code:             'require_password_confirmation' => true
CVE-2021-27904: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided view access to unintended actors.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2021-03-02T07:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/SharingGroupServer.php
Commit date: 2021-03-01 23:47:01 +0100
Commit message: fix: [security] sharing group all org flag too lax

- the all org flag was used as a trigger to make the sharing group obejct itself viewable to all local organisations
- even if the all org flag was set for an instance other than the local one

- as reported by Jeroen Pinoy

Diff: diff --git a/app/Model/SharingGroupServer.php b/app/Model/SharingGroupServer.php
index f96ed5e6098..18a7f334f60 100644
--- a/app/Model/SharingGroupServer.php
+++ b/app/Model/SharingGroupServer.php
@@ -96,11 +96,11 @@ class SharingGroupServer extends AppModel
 
     // pass a sharing group ID, returns true if it has an attached server object with "all_orgs" ticked
     public function checkIfAuthorised($id)
     {
         $sg = $this->find('first', array(
-                'conditions' => array('sharing_group_id' => $id, 'all_orgs' => 1),
+                'conditions' => array('sharing_group_id' => $id, 'all_orgs' => 1, 'server_id' => 0),
                 'recursive' => -1,
                 'fields' => array('id'),
         ));
         if (!empty($sg)) {
             return true;

Vulnerable code:                 'conditions' => array('sharing_group_id' => $id, 'all_orgs' => 1),
Fixed code:                 'conditions' => array('sharing_group_id' => $id, 'all_orgs' => 1, 'server_id' => 0),
CVE-2021-3184: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-01-19T16:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Elements/global_menu.ctp
Commit date: 2021-01-19 16:04:38 +0100
Commit message: fix: [security] XSS in the user homepage favourite button

- navigating to a url in MISP with the URL containing a javascript payload would cause the execution of reflected xss
- automatically sanitised by modern browsers, but still confirmed via raw curl fetches

Diff: diff --git a/app/View/Elements/global_menu.ctp b/app/View/Elements/global_menu.ctp
index e93aa2500b1..0a97da9e2dd 100755
--- a/app/View/Elements/global_menu.ctp
+++ b/app/View/Elements/global_menu.ctp
@@ -462,11 +462,11 @@
                 'html' => sprintf(
                     '<span class="fas fa-star %s" id="setHomePage" title="%s" role="img" aria-label="%s" data-current-page="%s"></span>',
                     (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : '',
 		    __('Set the current page as your home page in MISP'),
 		    __('Set the current page as your home page in MISP'),
-                    $this->here
+                    h($this->here)
                 )
             ),
             array(
                 'type' => 'root',
                 'url' => empty($homepage['path']) ? $baseurl : $baseurl . h($homepage['path']),

Vulnerable code:                     $this->here
Fixed code:                     h($this->here)
CVE-2021-35502: Insufficient Information (NVD-CWE-noinfo)
value: app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-06-25T21:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp
Commit date: 2021-06-24 08:39:51 +0200
Commit message: security: [generic-template:index] Fixed unsanitized input

Diff: diff --git a/app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp b/app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp
index 06a9f9b42c0..5a3c871ed3c 100644
--- a/app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp
+++ b/app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp
@@ -6,11 +6,11 @@
             $data = implode($implodeGlue, array_map(function($entry) {
                 return h($entry);
             }, $data));
         } else {
             if (count($data) > 0) {
-                $data = $data[0];
+                $data = h($data[0]);
             } else {
                 $data = '';
             }
         }
     } else if (is_bool($data)) {

Vulnerable code:                 $data = $data[0];
Fixed code:                 $data = h($data[0]);
CVE-2021-36212: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-07-07T13:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/SharingGroups/view.ctp
Commit date: 2021-06-29 11:46:27 +0200
Commit message: security: fix stored xss in sharing groups view as reported by Nicolas Vidal from TEHTRIS.

Diff: diff --git a/app/View/SharingGroups/view.ctp b/app/View/SharingGroups/view.ctp
index 6500f7b210b..67014a47cf3 100644
--- a/app/View/SharingGroups/view.ctp
+++ b/app/View/SharingGroups/view.ctp
@@ -1,7 +1,7 @@
 <div class="roles view">
-<h2><?= __('Sharing Group %s', $sg['SharingGroup']['name']);?></h2>
+<h2><?= __('Sharing Group %s', h($sg['SharingGroup']['name']));?></h2>
 <div class="row-fluid"><div class="span8" style="margin:0">
 <?php
 $tableData = [
     ['key' => __('ID'), 'value' => $sg['SharingGroup']['id']],
     ['key' => __('UUID'), 'value' => $sg['SharingGroup']['uuid'], 'value_class' => 'quickSelect'],

Vulnerable code: <h2><?= __('Sharing Group %s', $sg['SharingGroup']['name']);?></h2>
Fixed code: <h2><?= __('Sharing Group %s', h($sg['SharingGroup']['name']));?></h2>
CVE-2021-37534: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-07-26T14:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/GalaxyClusters/add.ctp
Commit date: 2021-07-26 12:29:20 +0200
Commit message: fix: [security] Stored XSS when forking a galaxy cluster
As reported by Giuseppe Diego Gianni

Diff: diff --git a/app/View/GalaxyClusters/add.ctp b/app/View/GalaxyClusters/add.ctp
index 3228d52aa2e..2ce5fe421eb 100644
--- a/app/View/GalaxyClusters/add.ctp
+++ b/app/View/GalaxyClusters/add.ctp
@@ -3,11 +3,11 @@
     $forkedCluster = isset($forkedCluster) ? $forkedCluster : array();
     $forkedClusterHtmlPreview = '';
     if (isset($forkedClusterMeta)) {
         foreach ($forkedClusterMeta as $key => $value) {
             if (is_array($value)) {
-                $forkedClusterHtmlPreview .= sprintf('<div><b>%s: </b><div data-toggle="json" class="large-left-margin">%s</div></div>', h($key), json_encode($value));
+                $forkedClusterHtmlPreview .= sprintf('<div><b>%s: </b><div data-toggle="json" class="large-left-margin">%s</div></div>', h($key), json_encode(h($value)));
             } else {
                 $forkedClusterHtmlPreview .= sprintf('<div><b>%s: </b>%s</div>', h($key), h($value));
             }
         }
     }

Vulnerable code:                 $forkedClusterHtmlPreview .= sprintf('<div><b>%s: </b><div data-toggle="json" class="large-left-margin">%s</div></div>', h($key), json_encode($value));
Fixed code:                 $forkedClusterHtmlPreview .= sprintf('<div><b>%s: </b><div data-toggle="json" class="large-left-margin">%s</div></div>', h($key), json_encode(h($value)));
CVE-2021-37742: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-07-30T15:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Elements/GalaxyClusters/view_relation_tree.ctp
Commit date: 2021-07-29 13:44:53 +0200
Commit message: fix: [security] Stored XSS when viewing galaxy cluster relationships
- As reported by Dawid Czarnecki

Diff: diff --git a/app/View/Elements/GalaxyClusters/view_relation_tree.ctp b/app/View/Elements/GalaxyClusters/view_relation_tree.ctp
index b9b7e5c33a3..93f4d206df2 100644
--- a/app/View/Elements/GalaxyClusters/view_relation_tree.ctp
+++ b/app/View/Elements/GalaxyClusters/view_relation_tree.ctp
@@ -297,11 +297,11 @@ $randomClass = "relation-{$random}";
             .append("xhtml:div")
             .append("div")
             .attr("class", "well well-small")
             .style('padding', '4px 9px')
             .style('white-space', 'nowrap')
-            .html(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
+            .text(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
             
         paddingX = 8;
         gEnter.append("foreignObject")
             .attr("height", 18)
             .attr("y", 20)
@@ -317,11 +317,11 @@ $randomClass = "relation-{$random}";
                             .attr("class", "tag")
                             .style('white-space', 'nowrap')
                             .style('background-color', tag.colour)
                             .style('color', getTextColour(tag.colour))
                             .style('display', 'inline')
-                            .html(tag.name)
+                            .text(tag.name)
                     });
                 }
             });
 
     }

Vulnerable code:             .html(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
                            .html(tag.name)
Fixed code:             .text(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
                            .text(tag.name)
CVE-2021-37743: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-07-30T15:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/GalaxyElements/ajax/index.ctp
Commit date: 2021-07-29 13:44:11 +0200
Commit message: fix: [security] Stored XSS when viewing galaxy cluster elements in JSON format

Diff: diff --git a/app/View/GalaxyElements/ajax/index.ctp b/app/View/GalaxyElements/ajax/index.ctp
index 24290c49bdf..9bc542e090b 100644
--- a/app/View/GalaxyElements/ajax/index.ctp
+++ b/app/View/GalaxyElements/ajax/index.ctp
@@ -81,11 +81,11 @@ if ($context == 'JSONView') {
     $indexOptions['data']['actions'] = [];
 }
 
 echo $this->element('/genericElements/IndexTable/index_table', $indexOptions);
 if ($context == 'JSONView') {
-    echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode($JSONElements));
+    echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode(h($JSONElements)));
 }
 ?>
 
 <script>
     var $jsondiv = $('#elementJSONDiv');

Vulnerable code:     echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode($JSONElements));
Fixed code:     echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode(h($JSONElements)));
CVE-2021-39302: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2021-08-19T17:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Log.php
Commit date: 2021-08-19 14:55:30 +0200
Commit message: security: fix unescaped parameter leading to sqli

Diff: diff --git a/app/Model/Log.php b/app/Model/Log.php
index 71708f621a4..4e0d25775e0 100644
--- a/app/Model/Log.php
+++ b/app/Model/Log.php
@@ -172,11 +172,11 @@ class Log extends AppModel
         } elseif ($dataSource == 'Database/Postgres') {
             // manually generate the query for Postgres
             // cakephp ORM would escape "DATE" datatype in CAST expression
             $condnotinaction = "'" . implode("', '", $conditions['AND']['NOT']['action']) . "'";
             if (!empty($conditions['org'])) {
-                $condOrg = ' AND org = "' . $conditions['org'] . '"';
+                $condOrg = sprintf('AND org = %s', $this->getDataSource()->value($conditions['org']));
             } else {
                 $condOrg = '';
             }
             $sql = 'SELECT DISTINCT EXTRACT(EPOCH FROM CAST(created AS DATE)) AS "Date",
                                     COUNT(id) AS count

Vulnerable code:                 $condOrg = ' AND org = "' . $conditions['org'] . '"';
Fixed code:                 $condOrg = sprintf('AND org = %s', $this->getDataSource()->value($conditions['org']));
CVE-2022-27243: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2022-03-18T18:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Users/terms.ctp
Commit date: 2022-03-17 15:36:35 +0100
Commit message: fix: [security] lfi via custom terms file setting, as reported by Ianis BERNARD - NATO Cyber Security Centre

Diff: diff --git a/app/View/Users/terms.ctp b/app/View/Users/terms.ctp
index f431b30e9b3..8000b7b8dcd 100644
--- a/app/View/Users/terms.ctp
+++ b/app/View/Users/terms.ctp
@@ -3,11 +3,12 @@
 <?php
     $embedableExtensions = array('pdf');
     if (!Configure::read('MISP.terms_file')) {
         $termsFile = APP ."View/Users/terms";
     } else {
-        $termsFile = APP . 'files' . DS . 'terms' . DS . Configure::read('MISP.terms_file');
+        $customTermsFile = basename(realpath(Configure::read('MISP.terms_file')));
+        $termsFile = APP . 'files' . DS . 'terms' . DS . $customTermsFile;
     }
     if (!(file_exists($termsFile))) {
         echo "<p>" . __("Terms and Conditions file not found.") . "</p>";
     } else {
         if (!Configure::read('MISP.terms_download')) {

Vulnerable code:         $termsFile = APP . 'files' . DS . 'terms' . DS . Configure::read('MISP.terms_file');
Fixed code:         $customTermsFile = basename(realpath(Configure::read('MISP.terms_file')));
        $termsFile = APP . 'files' . DS . 'terms' . DS . $customTermsFile;
CVE-2022-27245: Server-Side Request Forgery (SSRF) (CWE-918)
value: An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 8.8
Published: 2022-03-18T18:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Server.php
Commit date: 2022-03-17 15:55:21 +0100
Commit message: fix: [security] restrict setting to cli only. enabling this setting could allow potential ssrf attacks, as reported by Ianis BERNARD - NATO Cyber Security Centre

Diff: diff --git a/app/Model/Server.php b/app/Model/Server.php
index 33667507dd4..f5d66192d66 100644
--- a/app/Model/Server.php
+++ b/app/Model/Server.php
@@ -5865,11 +5865,12 @@ class Server extends AppModel
                     'level' => 0,
                     'description' => __('Enable this setting if you wish for users to be able to query any arbitrary URL via the rest client. Keep in mind that queries are executed by the MISP server, so internal IPs in your MISP\'s network may be reachable.'),
                     'value' => false,
                     'test' => 'testBool',
                     'type' => 'boolean',
-                    'null' => true
+                    'null' => true,
+                    'cli_only' => 1
                 ),
                 'rest_client_baseurl' => array(
                     'level' => 1,
                     'description' => __('If left empty, the baseurl of your MISP is used. However, in some instances (such as port-forwarded VM installations) this will not work. You can override the baseurl with a url through which your MISP can reach itself (typically https://127.0.0.1 would work).'),
                     'value' => false,

Vulnerable code:                     'null' => true
Fixed code:                     'null' => true,
                    'cli_only' => 1