CVE-2023-50918: Insufficient Information (NVD-CWE-noinfo)
value: app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-12-15T18:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/AuditLogsController.php
Commit date: 2023-12-12 10:04:28 +0100
Commit message: fix: [security] new audit logs lack of ACL controls

- added proper ACL handling to the new audit logs
- as reported by fukusuket(Fukusuke Takahashi)

Diff: diff --git a/app/Controller/AuditLogsController.php b/app/Controller/AuditLogsController.php
index a58135d42d6..2ed9067aa79 100644
--- a/app/Controller/AuditLogsController.php
+++ b/app/Controller/AuditLogsController.php
@@ -89,10 +89,25 @@ class AuditLogsController extends AppController
             AuditLog::ACTION_PUBLISH => __('Publish'),
             AuditLog::ACTION_PUBLISH_SIGHTINGS => __('Publish sightings'),
         ];
     }
 
+    private function __applyAuditACL(array $user)
+    {
+        $acl = [];
+        if (empty($user['Role']['perm_site_admin'])) {
+            if (!empty($user['Role']['perm_admin'])) {
+                // ORG admins can see their own org info
+                $acl = ['AuditLog.org_id' => $user['org_id']];
+            } else {
+                // users can see their own info
+                $acl = ['AuditLog.user_id' => $user['id']];
+            }
+        }
+        return $acl;
+    }
+
     public function admin_index()
     {
         $this->paginate['fields'][] = 'ip';
         $this->paginate['fields'][] = 'request_type';
         $this->paginate['fields'][] = 'authkey_id';
@@ -117,10 +132,14 @@ class AuditLogsController extends AppController
             'created',
             'request_type',
         ]);
 
         $this->paginate['conditions'] = $this->__searchConditions($params);
+        $acl = $this->__applyAuditACL($this->Auth->user());
+        if ($acl) {
+            $this->paginate['conditions']['AND'][] = $acl;
+        }
         $list = $this->paginate();
 
         if ($this->_isRest()) {
             return $this->RestResponse->viewData($list, 'json');
         }
@@ -154,11 +173,10 @@ class AuditLogsController extends AppController
     {
         $event = $this->AuditLog->Event->fetchSimpleEvent($this->Auth->user(), $eventId);
         if (empty($event)) {
             throw new NotFoundException('Invalid event.');
         }
-
         $this->paginate['conditions'] = $this->__createEventIndexConditions($event);
         $this->set('passedArgsArray', ['eventId' => $eventId, 'org' => $org]);
 
         $params = $this->IndexFilter->harvestParameters(['created', 'org']);
         if ($org) {
@@ -231,10 +249,11 @@ class AuditLogsController extends AppController
     /**
      * @return array
      */
     private function __searchConditions(array $params)
     {
+        $conditions = [];
         $qbRules = [];
         foreach ($params as $key => $value) {
             if ($key === 'model' && strpos($value, ':') !== false) {
                 $parts = explode(':', $value);
                 $qbRules[] = [
@@ -261,11 +280,10 @@ class AuditLogsController extends AppController
                 ];
             }
         }
         $this->set('qbRules', $qbRules);
 
-        $conditions = [];
         if (isset($params['user'])) {
             if (strtoupper($params['user']) === 'SYSTEM') {
                 $conditions['AuditLog.user_id'] = 0;
             } else if (is_numeric($params['user'])) {
                 $conditions['AuditLog.user_id'] = $params['user'];
@@ -349,21 +367,19 @@ class AuditLogsController extends AppController
     {
         if ($this->_isSiteAdmin() || $event['Event']['orgc_id'] == $this->Auth->user('org_id')) {
             // Site admins and event owners can see all changes
             return ['event_id' => $event['Event']['id']];
         }
-
         $event = $this->AuditLog->Event->fetchEvent($this->Auth->user(), [
             'eventid' => $event['Event']['id'],
             'sgReferenceOnly' => 1,
             'deleted' => [0, 1],
             'deleted_proposals' => 1,
             'noSightings' => true,
             'includeEventCorrelations' => false,
             'excludeGalaxy' => true,
         ])[0];
-
         $attributeIds = [];
         $objectIds = [];
         $proposalIds = array_column($event['ShadowAttribute'], 'id');
         $objectReferenceId = [];
         foreach ($event['Attribute'] as $aa) {

Vulnerable code: 
        $conditions = [];


Fixed code:     private function __applyAuditACL(array $user)
    {
        $acl = [];
        if (empty($user['Role']['perm_site_admin'])) {
            if (!empty($user['Role']['perm_admin'])) {
                // ORG admins can see their own org info
                $acl = ['AuditLog.org_id' => $user['org_id']];
            } else {
                // users can see their own info
                $acl = ['AuditLog.user_id' => $user['id']];
            }
        }
        return $acl;
    }

        $acl = $this->__applyAuditACL($this->Auth->user());
        if ($acl) {
            $this->paginate['conditions']['AND'][] = $acl;
        }
        $conditions = [];