Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-29528: Deserialization of Untrusted Data (CWE-502)
value: An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2022-04-20T23:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/AppModel.php
Commit date: 2022-04-17 16:30:14 +0200
Commit message: fix: [security] unregister phar from stream wrappers globally for all Model code

- blanket protection against phar deserialization vulnerabilities

- as reported by Dawid Czarnecki of Zigrin Security

Diff: diff --git a/app/Model/AppModel.php b/app/Model/AppModel.php
index 08cdccd58c49..8edcea224e3c 100644
--- a/app/Model/AppModel.php
+++ b/app/Model/AppModel.php
@@ -49,10 +49,13 @@ class AppModel extends Model
 
     public function __construct($id = false, $table = null, $ds = null)
     {
         parent::__construct($id, $table, $ds);
         $this->findMethods['column'] = true;
+        if (in_array('phar', stream_get_wrappers())) {
+            stream_wrapper_unregister('phar');
+        }
     }
 
     // deprecated, use $db_changes
     // major -> minor -> hotfix -> requires_logout
     const OLD_DB_CHANGES = array(

Fixed code:         if (in_array('phar', stream_get_wrappers())) {
            stream_wrapper_unregister('phar');
        }
CVE-2022-29530: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-20T23:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/GalaxyClusters/view.ctp
Commit date: 2022-04-17 19:12:16 +0200
Commit message: fix: [security] XSS in galaxy clusters

- fixed a stored XSS in the galaxy clusters

- as reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army

Diff: diff --git a/app/View/GalaxyClusters/view.ctp b/app/View/GalaxyClusters/view.ctp
index 21ebc6021041..64a318d69e5d 100755
--- a/app/View/GalaxyClusters/view.ctp
+++ b/app/View/GalaxyClusters/view.ctp
@@ -54,11 +54,11 @@ $table_data[] = array('key' => __('Version'), 'value' => $cluster['GalaxyCluster
 $table_data[] = array('key' => __('UUID'), 'value' => $cluster['GalaxyCluster']['uuid'], 'value_class' => 'quickSelect');
 $table_data[] = array('key' => __('Collection UUID'), 'value' => $cluster['GalaxyCluster']['collection_uuid'], 'value_class' => 'quickSelect');
 $table_data[] = array(
     'key' => __('Source'),
     'html' => filter_var($cluster['GalaxyCluster']['source'], FILTER_VALIDATE_URL) ?
-        '<a href="' . $cluster['GalaxyCluster']['source'] . '" rel="noreferrer noopener">' . h($cluster['GalaxyCluster']['source']) :
+        '<a href="' . h($cluster['GalaxyCluster']['source']) . '" rel="noreferrer noopener">' . h($cluster['GalaxyCluster']['source']) :
         h($cluster['GalaxyCluster']['source']),
 );
 $table_data[] = array('key' => __('Authors'), 'value' => !empty($cluster['GalaxyCluster']['authors']) ? implode(', ', $cluster['GalaxyCluster']['authors']) : __('N/A'));
 $table_data[] = array('key' => __('Distribution'), 'element' => 'genericElements/IndexTable/Fields/distribution_levels', 'element_params' => array(
     'row' => $cluster['GalaxyCluster'],

Vulnerable code:         '<a href="' . $cluster['GalaxyCluster']['source'] . '" rel="noreferrer noopener">' . h($cluster['GalaxyCluster']['source']) :
Fixed code:         '<a href="' . h($cluster['GalaxyCluster']['source']) . '" rel="noreferrer noopener">' . h($cluster['GalaxyCluster']['source']) :
CVE-2022-29532: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-04-20T23:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
Commit date: 2022-04-18 00:58:31 +0200
Commit message: fix: [security] XSS in cerebrate view

- low probability XSS in the cerebrate view's URL field
- a malicious administrator could set a javascript: url
- another administrator would have to click the suspicious looking URL to be affected

- As reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army

Diff: diff --git a/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp b/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
index 17cd2cf782fc..44084423398e 100644
--- a/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
+++ b/app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
@@ -10,10 +10,15 @@ if (!empty($field['url'])) {
         if (!is_array($field['url_vars'])) {
             $field['url_vars'] = [$field['url_vars']];
         }
         foreach ($field['url_vars'] as $k => $path) {
             $field['url'] = str_replace('{{' . $k . '}}', Hash::extract($data, $path)[0], $field['url']);
+            $temp = explode(':', $field['url']);
+            if (!in_array(strtolower($temp[0]), ['http', 'https'])) {
+                $field['url'] = '#';
+                $string = 'Malformed URL - invalid protocol (' . h($temp[0]) . ':)';
+            }
         }
     }
     $string = sprintf(
         '<a href="%s">%s</a>',
         h($field['url']),

Fixed code:             $temp = explode(':', $field['url']);
            if (!in_array(strtolower($temp[0]), ['http', 'https'])) {
                $field['url'] = '#';
                $string = 'Malformed URL - invalid protocol (' . h($temp[0]) . ':)';
            }
CVE-2022-29533: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-20T23:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/OrganisationsController.php
Commit date: 2022-04-18 01:05:10 +0200
Commit message: fix: [security] low probability reflected XSS fixed

- User would need to navigate to a url that contains the payload
- user needs to click on a checkbox in a weird single checkbox page to trigger the exploit

- as reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army

Diff: diff --git a/app/Controller/OrganisationsController.php b/app/Controller/OrganisationsController.php
index 7d9f6345d721..06c9350e4242 100644
--- a/app/Controller/OrganisationsController.php
+++ b/app/Controller/OrganisationsController.php
@@ -390,11 +390,11 @@ class OrganisationsController extends AppController
 
     public function fetchSGOrgRow($id, $removable = false, $extend = false)
     {
         $this->layout = false;
         $this->autoRender = false;
-        $this->set('id', $id);
+        $this->set('id', (int)$id);
         $this->set('removable', $removable);
         $this->set('extend', $extend);
         $this->render('ajax/sg_org_row_empty');
     }
 

Vulnerable code:         $this->set('id', $id);
Fixed code:         $this->set('id', (int)$id);
CVE-2022-29534: Improper Authentication (CWE-287)
value: An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2022-04-20T23:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/UsersController.php
Commit date: 2022-04-18 02:00:13 +0200
Commit message: fix: [security] Password confirmation bypass in user edit

- optional password confirmation can be potentially circumvented
- fooling the user edit via a request that sets accept:application/json whilst posting form content

- as reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army

Diff: diff --git a/app/Controller/UsersController.php b/app/Controller/UsersController.php
index 186a27aa0542..6f3f5f2890d1 100644
--- a/app/Controller/UsersController.php
+++ b/app/Controller/UsersController.php
@@ -152,11 +152,11 @@ class UsersController extends AppController
                     if ($abortPost) {
                         $message = __('Invalid e-mail domain. Your user is restricted to creating users for the following domain(s): ') . implode(', ', $organisation['Organisation']['restricted_to_domain']);
                     }
                 }
             }
-            if (!$abortPost && !$this->_isRest()) {
+            if (!$abortPost && (!$this->_isRest() || empty($this->request->header('Authorization')))) {
                 if (Configure::read('Security.require_password_confirmation')) {
                     if (!empty($this->request->data['User']['current_password'])) {
                         $hashed = $this->User->verifyPassword($this->Auth->user('id'), $this->request->data['User']['current_password']);
                         if (!$hashed) {
                             $abortPost = true;
@@ -851,11 +851,11 @@ class UsersController extends AppController
         if ($this->request->is('post') || $this->request->is('put')) {
             if (!isset($this->request->data['User'])) {
                 $this->request->data['User'] = $this->request->data;
             }
             $abortPost = false;
-            if (!$this->_isRest()) {
+            if (!$this->_isRest() || empty($this->request->header('Authorization'))) {
                 if (Configure::read('Security.require_password_confirmation')) {
                     if (!empty($this->request->data['User']['current_password'])) {
                         $hashed = $this->User->verifyPassword($this->Auth->user('id'), $this->request->data['User']['current_password']);
                         if (!$hashed) {
                             $abortPost = true;

Vulnerable code:             if (!$abortPost && !$this->_isRest()) {
            if (!$this->_isRest()) {
Fixed code:             if (!$abortPost && (!$this->_isRest() || empty($this->request->header('Authorization')))) {
            if (!$this->_isRest() || empty($this->request->header('Authorization'))) {
CVE-2022-48328: Improper Handling of Exceptional Conditions (CWE-755)
value: app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 9.8
Published: 2023-02-20T04:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/Component/IndexFilterComponent.php
Commit date: 2022-12-22 15:35:30 +0100
Commit message: chg: [runaway function] split into easier to comprehend ones

Diff: diff --git a/app/Controller/Component/IndexFilterComponent.php b/app/Controller/Component/IndexFilterComponent.php
index 89aad9cb39..8d78351aaa 100644
--- a/app/Controller/Component/IndexFilterComponent.php
+++ b/app/Controller/Component/IndexFilterComponent.php
@@ -43,10 +43,22 @@ class IndexFilterComponent extends Component
                     $data = $request->data;
                 }
             }
         }
 
+        $data = $this->__massageData($data, $request, $paramArray);
+
+        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
+        return $data;
+    }
+
+    private function __massageData($data, $request, $paramArray)
+    {
+        $data = array_filter($data, function($paramName) use ($paramArray) {
+            return !empty($paramArray[$paramName]);
+        }, ARRAY_FILTER_USE_KEY);
+
         if (!empty($paramArray)) {
             foreach ($paramArray as $p) {
                 if (isset($request->params['named'][$p])) {
                     $data[$p] = str_replace(';', ':', $request->params['named'][$p]);
                 }
@@ -59,17 +71,12 @@ class IndexFilterComponent extends Component
                     $v = explode('||', $v);
                 }
             }
         }
         unset($v);
-        
-        $data = array_filter($data, function($paramName) use ($paramArray) {
-            return !empty($paramArray[$paramName]);
-        }, ARRAY_FILTER_USE_KEY);
-
-        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
         return $data;
+
     }
 
     public function isRest()
     {
         // This method is surprisingly slow and called many times for one request, so it make sense to cache the result.

Vulnerable code:         
        $data = array_filter($data, function($paramName) use ($paramArray) {
            return !empty($paramArray[$paramName]);
        }, ARRAY_FILTER_USE_KEY);

        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
Fixed code:         $data = $this->__massageData($data, $request, $paramArray);

        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
        return $data;
    }

    private function __massageData($data, $request, $paramArray)
    {
        $data = array_filter($data, function($paramName) use ($paramArray) {
            return !empty($paramArray[$paramName]);
        }, ARRAY_FILTER_USE_KEY);
CVE-2022-48329: Improper Handling of Exceptional Conditions (CWE-755)
value: MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 9.8
Published: 2023-02-20T04:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/Attribute.php
Commit date: 2022-11-28 11:05:34 +0100
Commit message: chg: [attribute] rearranging fixed

Diff: diff --git a/app/Model/Attribute.php b/app/Model/Attribute.php
index 7658258f2e..9d146e8c06 100644
--- a/app/Model/Attribute.php
+++ b/app/Model/Attribute.php
@@ -1703,11 +1703,18 @@ class Attribute extends AppModel
             $params['conditions']['AND'][] = $options['conditions'];
         }
         if (empty($options['flatten'])) {
             $params['conditions']['AND'][] = array('Attribute.object_id' => 0);
         }
-        $params['order'] = isset($options['order']) ? $options['order'] : [];
+        $params['order'] = [];
+        if (!empty($options['order'])) {
+            $options['order'] = $this->findOrder(
+                $options['order'],
+                'Attribute',
+                ['id', 'event_id', 'object_id', 'type', 'category', 'value', 'distribution', 'timestamp', 'object_relation']
+            );
+        }
         if (!isset($options['withAttachments'])) {
             $options['withAttachments'] = false;
         }
         if (!isset($options['enforceWarninglist'])) {
             $options['enforceWarninglist'] = false;

Vulnerable code:         $params['order'] = isset($options['order']) ? $options['order'] : [];
Fixed code:         $params['order'] = [];
        if (!empty($options['order'])) {
            $options['order'] = $this->findOrder(
                $options['order'],
                'Attribute',
                ['id', 'event_id', 'object_id', 'type', 'category', 'value', 'distribution', 'timestamp', 'object_relation']
            );
        }
CVE-2023-24027: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-20T22:15Z
Repository: https://github.com/MISP/MISP
Language: JavaScript
Files changed: app/webroot/js/action_table.js
Commit date: 2023-01-18 15:00:50 +0100
Commit message: fix: [security] XSS through network history name

- as reported by Cyber Controls from SIX Group

Diff: diff --git a/app/webroot/js/action_table.js b/app/webroot/js/action_table.js
index 2bd54af979..103e36f4db 100644
--- a/app/webroot/js/action_table.js
+++ b/app/webroot/js/action_table.js
@@ -160,11 +160,11 @@ class ActionTable {
     __add_row(row) {
         var tr = document.createElement('tr');
         tr.id = "tr_" + this.__uuidv4();
         for (var col of row) {
             var td = document.createElement('td');
-            td.innerHTML = col;
+            td.textContent = col;
             tr.appendChild(td);
         }
         this.__add_action_button(tr);
         this.tbody.appendChild(tr);
         return tr.id;

Vulnerable code:             td.innerHTML = col;
Fixed code:             td.textContent = col;
CVE-2023-24028: Other (NVD-CWE-Other)
value: In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2023-01-20T22:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/Component/ACLComponent.php
Commit date: 2023-01-18 15:05:46 +0100
Commit message: fix: [security] Prevent unauthorized access to decaying import function

- as reported by Cyber Controls from SIX Group

Diff: diff --git a/app/Controller/Component/ACLComponent.php b/app/Controller/Component/ACLComponent.php
index c78f98c154e..99390e34d06 100644
--- a/app/Controller/Component/ACLComponent.php
+++ b/app/Controller/Component/ACLComponent.php
@@ -123,11 +123,11 @@ class ACLComponent extends Component
                 'deleteTemplate' => array('*')
             ),
             'decayingModel' => array(
                 "update" => array(),
                 "export" => array('*'),
-                "import" => array('*'),
+                "import" => array('OR' => array('perm_admin', 'perm_decaying')),
                 "view" => array('*'),
                 "index" => array('*'),
                 "add" => array( 'OR' => array('perm_admin', 'perm_decaying')),
                 "edit" => array( 'OR' => array('perm_admin', 'perm_decaying')),
                 "delete" => array( 'OR' => array('perm_admin', 'perm_decaying')),

Vulnerable code:                 "import" => array('*'),
Fixed code:                 "import" => array('OR' => array('perm_admin', 'perm_decaying')),
CVE-2023-28607: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-18T18:15Z
Repository: https://github.com/MISP/MISP
Language: JavaScript
Files changed: app/webroot/js/event-graph.js
Commit date: 2023-03-10 11:11:13 +0100
Commit message: fix: [security] XSS in event-graph relationship tooltip


Diff: diff --git a/app/webroot/js/event-graph.js b/app/webroot/js/event-graph.js
index e025803ae74..f44bba489f4 100644
--- a/app/webroot/js/event-graph.js
+++ b/app/webroot/js/event-graph.js
@@ -820,11 +820,11 @@ class EventGraph {
             var rel = {
                 id: rel.id,
                 from: rel.from,
                 to: rel.to,
                 label: rel.type,
-                title: rel.comment,
+                title: escapeHtml(rel.comment),
                 color: {
                     opacity: 1.0,
                 }
             };
             newRelations.push(rel);

Vulnerable code:                 title: rel.comment,
Fixed code:                 title: escapeHtml(rel.comment),
CVE-2023-28884: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-27T03:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Lib/Tools/CustomPaginationTool.php
Commit date: 2023-03-25 09:27:57 +0100
Commit message: fix: [security] XSS in community index

- As reported by Zigrin Security

Diff: diff --git a/app/Lib/Tools/CustomPaginationTool.php b/app/Lib/Tools/CustomPaginationTool.php
index 525de820178..ad052af385b 100644
--- a/app/Lib/Tools/CustomPaginationTool.php
+++ b/app/Lib/Tools/CustomPaginationTool.php
@@ -25,10 +25,12 @@ class CustomPaginationTool
             if (isset($options[$v])) {
                 $params[$v] = $options[$v];
                 $params['options'][$v] = $options[$v];
             }
         }
+        $params['page'] = is_numeric($params['page']) ? $params['page'] : 1;
+        $params['limit'] = is_numeric($params['limit']) ? $params['limit'] : 60;
         $maxPage = floor($params['count'] / $params['limit']);
         if ($params['count'] % $params['limit'] != 0) {
             $maxPage += 1;
         }
         if ($params['page'] == 0) {

Fixed code:         $params['page'] = is_numeric($params['page']) ? $params['page'] : 1;
        $params['limit'] = is_numeric($params['limit']) ? $params['limit'] : 60;
CVE-2023-40224: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-10T20:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Events/index.ctp
Commit date: 2023-08-09 09:47:44 +0200
Commit message: fix: [security] XSS in event index

- As reported by Marcos Rrodriguez S-V

Diff: diff --git a/app/View/Events/index.ctp b/app/View/Events/index.ctp
index 8b1c654878c..fe07c01a639 100644
--- a/app/View/Events/index.ctp
+++ b/app/View/Events/index.ctp
@@ -66,11 +66,11 @@
                         array(
                             'id' => 'create-button',
                             'title' => __('Modify filters'),
                             'fa-icon' => 'search',
                             'onClick' => 'getPopup',
-                            'onClickParams' => array($urlparams, 'events', 'filterEventIndex')
+                            'onClickParams' => array(h($urlparams), 'events', 'filterEventIndex')
                         )
                     )
                 ),
                 array(
                     'children' => array(

Vulnerable code:                             'onClickParams' => array($urlparams, 'events', 'filterEventIndex')
Fixed code:                             'onClickParams' => array(h($urlparams), 'events', 'filterEventIndex')
CVE-2023-41098: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-23T06:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/DashboardsController.php
Commit date: 2023-08-11 09:53:21 +0200
Commit message: fix: [security] reflected xss on dashboard edit

Diff: diff --git a/app/Controller/DashboardsController.php b/app/Controller/DashboardsController.php
index e9bc0d208c2..944e7c66400 100644
--- a/app/Controller/DashboardsController.php
+++ b/app/Controller/DashboardsController.php
@@ -91,10 +91,13 @@ class DashboardsController extends AppController
         if ($this->request->is(['post', 'put'])) {
             $data = $this->request->data;
             if (empty($data['config'])) {
                 $data['config'] = '';
             }
+            if (!empty($data['id']) && !preg_match('/^[\w\d_]+$/i', $data['id'])) {
+                throw new BadRequestException(__('Invalid widget id provided.'));
+            }
             if ($action === 'add') {
                 $data['widget_options'] = $this->Dashboard->loadAllWidgets($this->Auth->user());
             } else if ($action === 'edit') {
                 if (!isset($data['widget'])) {
                     throw new BadRequestException(__('No widget name passed.'));

Fixed code:             if (!empty($data['id']) && !preg_match('/^[\w\d_]+$/i', $data['id'])) {
                throw new BadRequestException(__('Invalid widget id provided.'));
            }
CVE-2023-48655: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-11-17T05:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/Component/IndexFilterComponent.php
Commit date: 2023-09-13 08:18:15 +0200
Commit message: fix: properly filter out query parameters

Diff: diff --git a/app/Controller/Component/IndexFilterComponent.php b/app/Controller/Component/IndexFilterComponent.php
index 15fc739241f..064a0bb871d 100644
--- a/app/Controller/Component/IndexFilterComponent.php
+++ b/app/Controller/Component/IndexFilterComponent.php
@@ -52,11 +52,11 @@ class IndexFilterComponent extends Component
     }
 
     private function __massageData($data, $request, $paramArray)
     {
         $data = array_filter($data, function($paramName) use ($paramArray) {
-            return in_array($paramName, $paramArray);
+            return in_array($paramName, $paramArray, true);
         }, ARRAY_FILTER_USE_KEY);
 
         if (!empty($paramArray)) {
             foreach ($paramArray as $p) {
                 if (isset($request->params['named'][$p])) {

Vulnerable code:             return in_array($paramName, $paramArray);
Fixed code:             return in_array($paramName, $paramArray, true);
CVE-2023-48656: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-11-17T05:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/AppModel.php
Commit date: 2023-09-11 12:35:41 +0200
Commit message: fix: fixed invalid ordering errors

Diff: diff --git a/app/Model/AppModel.php b/app/Model/AppModel.php
index d14b0717e2c..974c97828e9 100644
--- a/app/Model/AppModel.php
+++ b/app/Model/AppModel.php
@@ -3987,6 +3987,34 @@ class AppModel extends Model
         if ($ipHeader && isset($_SERVER[$ipHeader])) {
             return trim($_SERVER[$ipHeader]);
         }
         return $_SERVER['REMOTE_ADDR'] ?? null;
     }
+
+    public function find($type = 'first', $query = array()) {
+        if (!empty($query['order']) && $this->validOrderClause($query['order']) === false) {
+            throw new InvalidArgumentException('Invalid order clause');
+        }
+
+        return parent::find($type, $query);
+    }
+
+    private function validOrderClause($order){
+        $pattern = '/^[\w\_\-\.\(\) ]+$/';
+        if(is_string($order) && preg_match($pattern, $order)){
+            return true;
+        }
+
+        if (is_array($order)) {
+            foreach ($order as $key => $value) {
+                if (is_string($key) && is_string($value) && preg_match($pattern, $key) && in_array(strtolower($value), ['asc', 'desc'])) {
+                    return true;
+                }
+                if(is_numeric($key) && is_string($value) && preg_match($pattern, $value)){
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
 }

Fixed code: 
    public function find($type = 'first', $query = array()) {
        if (!empty($query['order']) && $this->validOrderClause($query['order']) === false) {
            throw new InvalidArgumentException('Invalid order clause');
        }

        return parent::find($type, $query);
    }

    private function validOrderClause($order){
        $pattern = '/^[\w\_\-\.\(\) ]+$/';
        if(is_string($order) && preg_match($pattern, $order)){
            return true;
        }

        if (is_array($order)) {
            foreach ($order as $key => $value) {
                if (is_string($key) && is_string($value) && preg_match($pattern, $key) && in_array(strtolower($value), ['asc', 'desc'])) {
                    return true;
                }
                if(is_numeric($key) && is_string($value) && preg_match($pattern, $value)){
                    return true;
                }
            }
        }

        return false;
    }
CVE-2023-48658: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-11-17T05:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/AppModel.php
Commit date: 2023-09-14 12:52:19 +0200
Commit message: chg: [helper] Added param sanity check helper function
Diff: diff --git a/app/Model/AppModel.php b/app/Model/AppModel.php
index e82e0723af5..5364633a49b 100644
--- a/app/Model/AppModel.php
+++ b/app/Model/AppModel.php
@@ -4019,6 +4019,11 @@ class AppModel extends Model
             }
         }
 
         return false;
     }
+
+    public function checkParam($param)
+    {
+        return preg_match('/^[\w\_\-\. ]+$/', $param);
+    }
 }

Fixed code: 
    public function checkParam($param)
    {
        return preg_match('/^[\w\_\-\. ]+$/', $param);
    }
CVE-2024-29859: Insufficient Information (NVD-CWE-noinfo)
value: In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T04:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/EventsController.php
Commit date: 2024-03-05 13:54:28 +0100
Commit message: fix: [security] properly check for valid file upload

- as kindly reported by Rémi Matasse and Raphael Lob from Synacktiv (https://www.synacktiv.com)

Diff: diff --git a/app/Controller/EventsController.php b/app/Controller/EventsController.php
index 466c767aeb4..1b3f7d84da7 100644
--- a/app/Controller/EventsController.php
+++ b/app/Controller/EventsController.php
@@ -2367,20 +2367,25 @@ class EventsController extends AppController
                         $this->Flash->error(__('You may only upload MISP XML or MISP JSON files.'));
                         throw new MethodNotAllowedException(__('File upload failed or file does not have the expected extension (.xml / .json).'));
                     }
 
                     $isXml = $ext === 'xml';
-                    $data = FileAccessTool::readFromFile($file['tmp_name'], $file['size']);
+                    $matches = null;
+                    $tmp_name = $file['tmp_name'];
+                    if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($file['tmp_name'])) {
+                        $data = FileAccessTool::readFromFile($matches[0][0], $file['size']);
+                    } else {
+                        throw new NotFoundException(__('Invalid file.'));    
+                    }
                 } else {
                     throw new MethodNotAllowedException(__('No file uploaded.'));
                 }
 
                 $takeOwnership = Configure::read('MISP.take_ownership_xml_import')
                     && (isset($this->request->data['Event']['takeownership']) && $this->request->data['Event']['takeownership'] == 1);
 
                 $publish = $this->request->data['Event']['publish'] ?? false;
-
                 try {
                     $results = $this->Event->addMISPExportFile($this->Auth->user(), $data, $isXml, $takeOwnership, $publish);
                 } catch (Exception $e) {
                     $this->log("Exception during processing MISP file import: {$e->getMessage()}");
                     $this->Flash->error(__('Could not process MISP export file. %s', $e->getMessage()));

Vulnerable code:                     $data = FileAccessTool::readFromFile($file['tmp_name'], $file['size']);

Fixed code:                     $matches = null;
                    $tmp_name = $file['tmp_name'];
                    if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($file['tmp_name'])) {
                        $data = FileAccessTool::readFromFile($matches[0][0], $file['size']);
                    } else {
                        throw new NotFoundException(__('Invalid file.'));    
                    }
CVE-2021-21418: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-03-31T18:15Z
Repository: https://github.com/PrestaShop/ps_emailsubscription
Language: Unknown
Commit date: 2021-03-30 14:13:31 +0200
Commit message: Merge pull request from GHSA-vwfx-hh3w-fj99

Escape newsletter condition field
CVE-2016-10169: Out-of-bounds Read (CWE-125)
value: The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-14T14:59Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: src/open_utils.c, src/read_words.c
Commit date: 2016-12-21 22:18:36 -0800
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list

Diff: diff --git a/src/open_utils.c b/src/open_utils.c
index 7519f99..a844046 100644
--- a/src/open_utils.c
+++ b/src/open_utils.c
@@ -558,11 +558,11 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
         wpc->channel_reordering = NULL;
     }
 
     // if there's any data, the first two bytes are file_format and qmode flags
 
-    if (bytecnt) {
+    if (bytecnt >= 2) {
         wpc->file_format = *byteptr++;
         wpc->config.qmode = (wpc->config.qmode & ~0xff) | *byteptr++;
         bytecnt -= 2;
 
         // another byte indicates a channel layout
@@ -591,10 +591,14 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
 
                     if (wpc->channel_reordering) {
                         for (i = 0; i < nchans; ++i)
                             if (bytecnt) {
                                 wpc->channel_reordering [i] = *byteptr++;
+
+                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
+                                    wpc->channel_reordering [i] = 0;
+
                                 bytecnt--;
                             }
                             else
                                 wpc->channel_reordering [i] = i;
                     }
diff --git a/src/read_words.c b/src/read_words.c
index 62acac3..a537bfa 100644
--- a/src/read_words.c
+++ b/src/read_words.c
@@ -286,10 +286,14 @@ int32_t FASTCALL get_word (WavpackStream *wps, int chan, int32_t *correction)
         }
     }
 
     low &= 0x7fffffff;
     high &= 0x7fffffff;
+
+    if (low > high)         // make sure high and low make sense
+        high = low;
+
     mid = (high + low + 1) >> 1;
 
     if (!c->error_limit)
         mid = read_code (&wps->wvbits, high - low) + low;
     else while (high - low > c->error_limit) {

Vulnerable code:     if (bytecnt) {
Fixed code:     if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2016-10170: Out-of-bounds Read (CWE-125)
value: The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-14T14:59Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: src/open_utils.c, src/read_words.c
Commit date: 2016-12-21 22:18:36 -0800
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list

Diff: diff --git a/src/open_utils.c b/src/open_utils.c
index 7519f99..a844046 100644
--- a/src/open_utils.c
+++ b/src/open_utils.c
@@ -558,11 +558,11 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
         wpc->channel_reordering = NULL;
     }
 
     // if there's any data, the first two bytes are file_format and qmode flags
 
-    if (bytecnt) {
+    if (bytecnt >= 2) {
         wpc->file_format = *byteptr++;
         wpc->config.qmode = (wpc->config.qmode & ~0xff) | *byteptr++;
         bytecnt -= 2;
 
         // another byte indicates a channel layout
@@ -591,10 +591,14 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
 
                     if (wpc->channel_reordering) {
                         for (i = 0; i < nchans; ++i)
                             if (bytecnt) {
                                 wpc->channel_reordering [i] = *byteptr++;
+
+                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
+                                    wpc->channel_reordering [i] = 0;
+
                                 bytecnt--;
                             }
                             else
                                 wpc->channel_reordering [i] = i;
                     }
diff --git a/src/read_words.c b/src/read_words.c
index 62acac3..a537bfa 100644
--- a/src/read_words.c
+++ b/src/read_words.c
@@ -286,10 +286,14 @@ int32_t FASTCALL get_word (WavpackStream *wps, int chan, int32_t *correction)
         }
     }
 
     low &= 0x7fffffff;
     high &= 0x7fffffff;
+
+    if (low > high)         // make sure high and low make sense
+        high = low;
+
     mid = (high + low + 1) >> 1;
 
     if (!c->error_limit)
         mid = read_code (&wps->wvbits, high - low) + low;
     else while (high - low > c->error_limit) {

Vulnerable code:     if (bytecnt) {
Fixed code:     if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2016-10171: Out-of-bounds Read (CWE-125)
value: The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-14T14:59Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: src/open_utils.c, src/read_words.c
Commit date: 2016-12-21 22:18:36 -0800
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list

Diff: diff --git a/src/open_utils.c b/src/open_utils.c
index 7519f99..a844046 100644
--- a/src/open_utils.c
+++ b/src/open_utils.c
@@ -558,11 +558,11 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
         wpc->channel_reordering = NULL;
     }
 
     // if there's any data, the first two bytes are file_format and qmode flags
 
-    if (bytecnt) {
+    if (bytecnt >= 2) {
         wpc->file_format = *byteptr++;
         wpc->config.qmode = (wpc->config.qmode & ~0xff) | *byteptr++;
         bytecnt -= 2;
 
         // another byte indicates a channel layout
@@ -591,10 +591,14 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
 
                     if (wpc->channel_reordering) {
                         for (i = 0; i < nchans; ++i)
                             if (bytecnt) {
                                 wpc->channel_reordering [i] = *byteptr++;
+
+                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
+                                    wpc->channel_reordering [i] = 0;
+
                                 bytecnt--;
                             }
                             else
                                 wpc->channel_reordering [i] = i;
                     }
diff --git a/src/read_words.c b/src/read_words.c
index 62acac3..a537bfa 100644
--- a/src/read_words.c
+++ b/src/read_words.c
@@ -286,10 +286,14 @@ int32_t FASTCALL get_word (WavpackStream *wps, int chan, int32_t *correction)
         }
     }
 
     low &= 0x7fffffff;
     high &= 0x7fffffff;
+
+    if (low > high)         // make sure high and low make sense
+        high = low;
+
     mid = (high + low + 1) >> 1;
 
     if (!c->error_limit)
         mid = read_code (&wps->wvbits, high - low) + low;
     else while (high - low > c->error_limit) {

Vulnerable code:     if (bytecnt) {
Fixed code:     if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2016-10172: Out-of-bounds Read (CWE-125)
value: The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-14T14:59Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: src/open_utils.c, src/read_words.c
Commit date: 2016-12-21 22:18:36 -0800
Commit message: fixes for 4 fuzz failures posted to SourceForge mailing list

Diff: diff --git a/src/open_utils.c b/src/open_utils.c
index 7519f99..a844046 100644
--- a/src/open_utils.c
+++ b/src/open_utils.c
@@ -558,11 +558,11 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
         wpc->channel_reordering = NULL;
     }
 
     // if there's any data, the first two bytes are file_format and qmode flags
 
-    if (bytecnt) {
+    if (bytecnt >= 2) {
         wpc->file_format = *byteptr++;
         wpc->config.qmode = (wpc->config.qmode & ~0xff) | *byteptr++;
         bytecnt -= 2;
 
         // another byte indicates a channel layout
@@ -591,10 +591,14 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
 
                     if (wpc->channel_reordering) {
                         for (i = 0; i < nchans; ++i)
                             if (bytecnt) {
                                 wpc->channel_reordering [i] = *byteptr++;
+
+                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
+                                    wpc->channel_reordering [i] = 0;
+
                                 bytecnt--;
                             }
                             else
                                 wpc->channel_reordering [i] = i;
                     }
diff --git a/src/read_words.c b/src/read_words.c
index 62acac3..a537bfa 100644
--- a/src/read_words.c
+++ b/src/read_words.c
@@ -286,10 +286,14 @@ int32_t FASTCALL get_word (WavpackStream *wps, int chan, int32_t *correction)
         }
     }
 
     low &= 0x7fffffff;
     high &= 0x7fffffff;
+
+    if (low > high)         // make sure high and low make sense
+        high = low;
+
     mid = (high + low + 1) >> 1;
 
     if (!c->error_limit)
         mid = read_code (&wps->wvbits, high - low) + low;
     else while (high - low > c->error_limit) {

Vulnerable code:     if (bytecnt) {
Fixed code:     if (bytecnt >= 2) {

                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
                                    wpc->channel_reordering [i] = 0;


    if (low > high)         // make sure high and low make sense
        high = low;
CVE-2018-19840: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 5.5
Published: 2018-12-04T09:29Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: src/pack_utils.c
Commit date: 2018-11-29 21:00:42 -0800
Commit message: issue #53: error out on zero sample rate

Diff: diff --git a/src/pack_utils.c b/src/pack_utils.c
index 2253f0d..2a83497 100644
--- a/src/pack_utils.c
+++ b/src/pack_utils.c
@@ -193,10 +193,15 @@ int WavpackSetConfiguration64 (WavpackContext *wpc, WavpackConfig *config, int64
     uint32_t flags, bps = 0;
     uint32_t chan_mask = config->channel_mask;
     int num_chans = config->num_channels;
     int i;
 
+    if (!config->sample_rate) {
+        strcpy (wpc->error_message, "sample rate cannot be zero!");
+        return FALSE;
+    }
+
     wpc->stream_version = (config->flags & CONFIG_COMPATIBLE_WRITE) ? CUR_STREAM_VERS : MAX_STREAM_VERS;
 
     if ((config->qmode & QMODE_DSD_AUDIO) && config->bytes_per_sample == 1 && config->bits_per_sample == 8) {
 #ifdef ENABLE_DSD
         wpc->dsd_multiplier = 1;

Fixed code:     if (!config->sample_rate) {
        strcpy (wpc->error_message, "sample rate cannot be zero!");
        return FALSE;
    }