CVE-2022-48329: Improper Handling of Exceptional Conditions (CWE-755)
value: MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 9.8
Published: 2023-02-20T04:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Model/GalaxyCluster.php, app/Model/Workflow.php, app/Plugin/Assets/models/behaviors/LogableBehavior.php
Commit date: 2022-11-28 11:12:58 +0100
Commit message: chg: [rearrange parameters] improve the way we allow users to rearrange data

- tie more endpoints into the new findOrder() functionality
- allow for new context specific ordering rules

Diff: diff --git a/app/Model/GalaxyCluster.php b/app/Model/GalaxyCluster.php
index 5643e05b6c..5179b21329 100644
--- a/app/Model/GalaxyCluster.php
+++ b/app/Model/GalaxyCluster.php
@@ -1061,12 +1061,16 @@ class GalaxyCluster extends AppModel
             $params['conditions']['AND'][] = $options['conditions'];
         }
         if (isset($options['group'])) {
             $params['group'] = $options['group'];
         }
-        if (isset($options['order'])) {
-            $params['order'] = $options['order'];
+        if (!empty($options['order'])) {
+            $options['order'] = $this->findOrder(
+                $options['order'],
+                'GalaxyCluster',
+                ['id', 'event_id', 'version', 'type', 'value', 'distribution', 'orgc_id', 'org_id', 'tag_name', 'galaxy_id']
+            );
         }
         if (isset($options['page'])) {
             $params['page'] = $options['page'];
         }
         if (isset($options['limit'])) {
diff --git a/app/Model/Workflow.php b/app/Model/Workflow.php
index 8c3c485077..2b5170db60 100644
--- a/app/Model/Workflow.php
+++ b/app/Model/Workflow.php
@@ -1154,13 +1154,20 @@ class Workflow extends AppModel
             $params['group'] = !empty($options['group']) ? $options['group'] : false;
         }
         if (isset($options['contain'])) {
             $params['contain'] = !empty($options['contain']) ? $options['contain'] : [];
         }
-        if (isset($options['order'])) {
-            $params['order'] = !empty($options['order']) ? $options['order'] : [];
+
+        $params['order'] = [];
+        if (!empty($options['order'])) {
+            $options['order'] = $this->findOrder(
+                $options['order'],
+                'Workflow',
+                ['id', 'name', 'timestmap', 'trigger_id', 'counter']
+            );
         }
+
         $workflows = $this->find('all', $params);
         return $workflows;
     }
 
     /**
diff --git a/app/Plugin/Assets/models/behaviors/LogableBehavior.php b/app/Plugin/Assets/models/behaviors/LogableBehavior.php
index 05e73d75d4..a0ce0ba3fb 100644
--- a/app/Plugin/Assets/models/behaviors/LogableBehavior.php
+++ b/app/Plugin/Assets/models/behaviors/LogableBehavior.php
@@ -159,14 +159,21 @@ class LogableBehavior extends ModelBehavior {
 				$this->settings[$Model->alias]['foreignKey'] => NULL,
 				'fields' => array(),
 				'limit' => 50);
 		$params = array_merge($defaults, $params);
 		$options = array(
-				'order' => $params['order'],
 				'conditions' => $params['conditions'],
 				'fields' => $params['fields'],
-				'limit' => $params['limit']);
+				'limit' => $params['limit']
+		);
+		if (!empty($options['order'])) {
+			$options['order'] = $Model->findOrder(
+				$options['order'],
+				'Attribute',
+				['id', 'action', 'model_id', 'model', 'ip', 'org', 'email']
+			);
+		}
 		if ($params[$this->settings[$Model->alias]['classField']] === NULL) {
 			$params[$this->settings[$Model->alias]['classField']] = $Model->alias;
 		}
 		if ($params[$this->settings[$Model->alias]['classField']]) {
 			if (isset($this->schema[$this->settings[$Model->alias]['classField']])) {

Vulnerable code:         if (isset($options['order'])) {
            $params['order'] = $options['order'];
        if (isset($options['order'])) {
            $params['order'] = !empty($options['order']) ? $options['order'] : [];
				'order' => $params['order'],
				'limit' => $params['limit']);
Fixed code:         if (!empty($options['order'])) {
            $options['order'] = $this->findOrder(
                $options['order'],
                'GalaxyCluster',
                ['id', 'event_id', 'version', 'type', 'value', 'distribution', 'orgc_id', 'org_id', 'tag_name', 'galaxy_id']
            );

        $params['order'] = [];
        if (!empty($options['order'])) {
            $options['order'] = $this->findOrder(
                $options['order'],
                'Workflow',
                ['id', 'name', 'timestmap', 'trigger_id', 'counter']
            );

				'limit' => $params['limit']
		);
		if (!empty($options['order'])) {
			$options['order'] = $Model->findOrder(
				$options['order'],
				'Attribute',
				['id', 'action', 'model_id', 'model', 'ip', 'org', 'email']
			);
		}