CVE-2023-48657: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-11-17T05:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/AppModel.php
Commit date: 2023-09-14 12:54:14 +0200
Commit message: chg: [restsearch internal] sanity check erroneous filters

Diff: diff --git a/app/Model/AppModel.php b/app/Model/AppModel.php
index e82e0723af5..2ee10aa8447 100644
--- a/app/Model/AppModel.php
+++ b/app/Model/AppModel.php
@@ -3290,30 +3290,36 @@ class AppModel extends Model
                 $filters = array($filters);
             }
             foreach ($filters as $f) {
                 if ($f === -1) {
                     foreach ($keys as $key) {
-                        $temp['OR'][$key][] = -1;
+                        if ($this->checkParam($key)) {
+                            $temp['OR'][$key][] = -1;
+                        }
                     }
                     continue;
                 }
                 // split the filter params into two lists, one for substring searches one for exact ones
                 if (is_string($f) && ($f[strlen($f) - 1] === '%' || $f[0] === '%')) {
                     foreach ($keys as $key) {
-                        if ($operator === 'NOT') {
-                            $temp[] = array($key . ' NOT LIKE' => $f);
-                        } else {
-                            $temp[] = array($key . ' LIKE' => $f);
-                            $temp[] = array($key => $f);
+                        if ($this->checkParam($key)) {
+                            if ($operator === 'NOT') {
+                                $temp[] = array($key . ' NOT LIKE' => $f);
+                            } else {
+                                $temp[] = array($key . ' LIKE' => $f);
+                                $temp[] = array($key => $f);
+                            }
                         }
                     }
                 } else {
                     foreach ($keys as $key) {
-                        if ($operator === 'NOT') {
-                            $temp[$key . ' !='][] = $f;
-                        } else {
-                            $temp['OR'][$key][] = $f;
+                        if ($this->checkParam($key)) {
+                            if ($operator === 'NOT') {
+                                $temp[$key . ' !='][] = $f;
+                            } else {
+                                $temp['OR'][$key][] = $f;
+                            }
                         }
                     }
                 }
             }
             $conditions['AND'][] = array($operator_composition[$operator] => $temp);

Vulnerable code:                         $temp['OR'][$key][] = -1;
                        if ($operator === 'NOT') {
                            $temp[] = array($key . ' NOT LIKE' => $f);
                        } else {
                            $temp[] = array($key . ' LIKE' => $f);
                            $temp[] = array($key => $f);
                        if ($operator === 'NOT') {
                            $temp[$key . ' !='][] = $f;
                        } else {
                            $temp['OR'][$key][] = $f;
Fixed code:                         if ($this->checkParam($key)) {
                            $temp['OR'][$key][] = -1;
                        }
                        if ($this->checkParam($key)) {
                            if ($operator === 'NOT') {
                                $temp[] = array($key . ' NOT LIKE' => $f);
                            } else {
                                $temp[] = array($key . ' LIKE' => $f);
                                $temp[] = array($key => $f);
                            }
                        if ($this->checkParam($key)) {
                            if ($operator === 'NOT') {
                                $temp[$key . ' !='][] = $f;
                            } else {
                                $temp['OR'][$key][] = $f;
                            }