CVE-2020-15411 (PHP, published 2020-06-30T14:15Z)
Description: value: An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/AttributesController.php
Commit message: fix: [security] Insufficient ACL checks in the attachment downloader fixed
- Thanks to Jakub Onderka for reporting it


Vulnerable code:
        $this->Attribute->id = $id;
        if (!$this->Attribute->exists()) {
            throw new NotFoundException(__('Invalid attribute'));
        $this->Attribute->read();
        if (!$this->_isSiteAdmin() &&
            $this->Auth->user('org_id') !=
            $this->Attribute->data['Event']['org_id'] &&
            (
                $this->Attribute->data['Event']['distribution'] == 0 ||
                $this->Attribute->data['Attribute']['distribution'] == 0
            )) {
            throw new UnauthorizedException(__('You do not have the permission to view this event.'));
        }
        $this->__downloadAttachment($this->Attribute->data['Attribute']);
        $this->Attribute->id = $id;
        if (!$this->Attribute->exists()) {
            throw new NotFoundException(__('Invalid attribute or no authorisation to view it.'));
        }
        $this->Attribute->read(null, $id);
        if (!$user['User']['siteAdmin'] &&
            $user['User']['org_id'] != $this->Attribute->data['Event']['org_id'] &&
            (
                $this->Attribute->data['Event']['distribution'] == 0 ||
                $this->Attribute->data['Attribute']['distribution'] == 0
            )) {
            throw new NotFoundException(__('Invalid attribute or no authorisation to view it.'));
        }
        $this->__downloadAttachment($this->Attribute->data['Attribute']);

Fixed code:
        if (is_numeric($id)) {
            $conditions = array('Attribute.id' => $id);
        } elseif (Validation::uuid($id)) {
            $conditions = array('Attribute.uuid' => $id);
        } else {
            throw new NotFoundException(__('Invalid attribute id.'));
        }
        $conditions['Attribute.type'] = array('attachment', 'malware-sample');
        $attributes = $this->Attribute->fetchAttributes($this->Auth->user(), array('conditions' => $conditions, 'flatten' => true));
        if (empty($attributes)) {
            throw new UnauthorizedException(__('Attribute does not exists or you do not have the permission to download this attribute.'));
        $this->__downloadAttachment($attributes[0]['Attribute']);
        if (is_numeric($id)) {
            $conditions = array('Attribute.id' => $id);
        } elseif (Validation::uuid($id)) {
            $conditions = array('Attribute.uuid' => $id);
        } else {
            throw new NotFoundException(__('Invalid attribute id.'));
        }
        $conditions['Attribute.type'] = array('attachment', 'malware-sample');
        $attributes = $this->Attribute->fetchAttributes($user, array('conditions' => $conditions, 'flatten' => true));
        if (empty($attributes)) {
            throw new UnauthorizedException(__('Attribute does not exists or you do not have the permission to download this attribute.'));
        }
        $this->__downloadAttachment($attributes[0]['Attribute']);