CVE-2023-48659: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-11-17T05:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/AppController.php
Commit date: 2023-09-14 12:55:17 +0200
Commit message: fix: [internal] improved parameter parsing

Diff: diff --git a/app/Controller/AppController.php b/app/Controller/AppController.php
index 3550c0fec22..728135d426f 100755
--- a/app/Controller/AppController.php
+++ b/app/Controller/AppController.php
@@ -960,10 +960,18 @@ class AppController extends Controller
             }
         }
         return $user;
     }
 
+    private function __captureParam($data, $param, $value)
+    {
+        if ($this->modelClass->checkParam($param)) {
+            $data[$param] = $value;
+        }
+        return $data;
+    }
+
     /**
      * generic function to standardise on the collection of parameters. Accepts posted request objects, url params, named url params
      * @param array $options
      * @param CakeResponse $exception
      * @param array $data
@@ -980,13 +988,25 @@ class AppController extends Controller
                     '/' . $request->params['controller'] . '/' . $request->action
                 );
                 return false;
             } else {
                 if (isset($request->data['request'])) {
-                    $data = array_merge($data, $request->data['request']);
+                    $temp = $request->data['request'];
                 } else {
-                    $data = array_merge($data, $request->data);
+                    $temp = $request->data;
+                }
+                if (empty($options['paramArray'])) {
+                    foreach ($options['paramArray'] as $param => $value) {
+                        $data = $this->__captureParam($data, $param, $value);
+                    }
+                    $data = array_merge($data, $temp);
+                } else {
+                    foreach ($options['paramArray'] as $param) {
+                        if (isset($temp[$param])) {
+                            $data[$param] = $temp[$param];
+                        }
+                    }
                 }
             }
         }
         /*
          * If we simply capture ordered URL params with func_get_args(), reassociate them.

Vulnerable code:                     $data = array_merge($data, $request->data['request']);
                    $data = array_merge($data, $request->data);
Fixed code:     private function __captureParam($data, $param, $value)
    {
        if ($this->modelClass->checkParam($param)) {
            $data[$param] = $value;
        }
        return $data;
    }

                    $temp = $request->data['request'];
                    $temp = $request->data;
                }
                if (empty($options['paramArray'])) {
                    foreach ($options['paramArray'] as $param => $value) {
                        $data = $this->__captureParam($data, $param, $value);
                    }
                    $data = array_merge($data, $temp);
                } else {
                    foreach ($options['paramArray'] as $param) {
                        if (isset($temp[$param])) {
                            $data[$param] = $temp[$param];
                        }
                    }