hitoshura25/cvefixes huggingface dataset:
CVE-2020-10247 (Other, published 2020-03-09T19:15Z)
Description: value: MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Elements/Events/View/sighting_field.ctp
app/webroot/js/misp.js
Commit message: fix: [security] Fixed presistent xss in the sighting popover tool

- As reported by an external pentest company on behalf of the Centre for Cyber security Belgium (CCB)


Vulnerable code:
      <i class="icon-thumbs-up useCursorPointer" title="<?php echo __('Add sighting');?>" role="button" tabindex="0" aria-label="<?php echo __('Add sighting');?>" onmouseover="flexibleAddSighting(this, '0', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($object['value']);?>', '<?php echo h($page); ?>', 'top');" onclick="addSighting('0', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($page); ?>');">&nbsp;</i>
      <i class="icon-thumbs-down useCursorPointer" title="<?php echo __('Mark as false-positive');?>" role="button" tabindex="0" aria-label="<?php echo __('Mark as false-positive');?>" onmouseover="flexibleAddSighting(this, '1', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($object['value']);?>', '<?php echo h($page); ?>', 'bottom');" onclick="addSighting('1', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($page); ?>');">&nbsp;</i>
function flexibleAddSighting(clicked, type, attribute_id, event_id, value, page, placement) {

Fixed code:
      <i class="icon-thumbs-up useCursorPointer" title="<?php echo __('Add sighting');?>" role="button" tabindex="0" aria-label="<?php echo __('Add sighting');?>" onmouseover="flexibleAddSighting(this, '0', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($page); ?>', 'top');" onclick="addSighting('0', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($page); ?>');">&nbsp;</i>
      <i class="icon-thumbs-down useCursorPointer" title="<?php echo __('Mark as false-positive');?>" role="button" tabindex="0" aria-label="<?php echo __('Mark as false-positive');?>" onmouseover="flexibleAddSighting(this, '1', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($page); ?>', 'bottom');" onclick="addSighting('1', '<?php echo h($object['id']); ?>', '<?php echo h($object['event_id']);?>', '<?php echo h($page); ?>');">&nbsp;</i>
function flexibleAddSighting(clicked, type, attribute_id, event_id, page, placement) {
CVE-2020-13153 (Other, published 2020-05-18T22:15Z)
Description: value: app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Events/resolved_attributes.ctp
Commit message: fix: [security] xss in the resolved attributes view

- thanks to Jakub Onderka for reporting it


Vulnerable code:
                            $popoverHTML .= '<span class=\'bold\'>' . $key . '</span>: <span class=\'blue bold\'>' . $popoverElement . '</span><br />';

Fixed code:
                            $popoverHTML .= '<span class=\'bold\'>' . $key . '</span>: <span class=\'blue bold\'>' . h($popoverElement) . '</span><br />';
CVE-2020-14969 (PHP, published 2020-06-22T12:15Z)
Description: value: app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Attribute.php
Commit message: fix: [security] missing ACL lookup on attribute correlations

- attribute correlation ACL checks are skipped when querying the attribute restsearch API revealing metadata about a correlating but unreachable attribute.

- Thanks to Jakub Onderka for his tireless work and for reporting this!


Vulnerable code:
    public function getRelatedAttributes($attribute, $fields=array(), $includeEventData = false)

            'conditions' => $conditions,
            'group' => array('Attribute.event_id'),
                    $results[$k]['Attribute']['RelatedAttribute'] = ($this->getRelatedAttributes($results[$k]['Attribute'], $attributeFields, true));

Fixed code:
    public function getRelatedAttributes($user, $attribute, $fields=array(), $includeEventData = false)
        $baseConditions = $this->buildConditions($user);
        $baseConditions['AND'][] = $conditions;
            'conditions' => $baseConditions,
            'group' => array('Attribute.id', 'Attribute.event_id', 'Attribute.object_id', 'Attribute.object_relation', 'Attribute.category', 'Attribute.type', 'Attribute.value', 'Attribute.uuid', 'Attribute.timestamp', 'Attribute.distribution', 'Attribute.sharing_group_id', 'Attribute.to_ids', 'Attribute.comment', 'Event.id', 'Event.uuid', 'Event.threat_level_id', 'Event.analysis', 'Event.info', 'Event.extends_uuid', 'Event.distribution', 'Event.sharing_group_id', 'Event.published', 'Event.date', 'Event.orgc_id', 'Event.org_id', 'Object.id', 'Object.uuid', 'Object.distribution', 'Object.name', 'Object.template_uuid', 'Object.distribution', 'Object.sharing_group_id'),
                ),
                'Object' => array(
                    'fields' => array(
                        'Object.id', 'Object.uuid', 'Object.distribution', 'Object.name', 'Object.template_uuid', 'Object.distribution', 'Object.sharing_group_id'
                    )
                    $results[$k]['Attribute']['RelatedAttribute'] = ($this->getRelatedAttributes($user, $results[$k]['Attribute'], $attributeFields, true));
CVE-2020-15412 (PHP, published 2020-06-30T14:15Z)
Description: value: An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/EventsController.php
Commit message: fix: [security] Check event ACL before allowing user to send event contact form


Vulnerable code:
        $id = $this->Toolbox->findIdByUuid($this->Event, $id);
        $this->Event->id = $id;
        if (!$this->Event->exists()) {
            $this->data = $this->Event->read(null, $id);

Fixed code:
/**
 * @property Event $Event
 */
        $events = $this->Event->fetchEvent($this->Auth->user(), array('eventid' => $id));
        if (empty($events)) {
            $this->data = $events[0];
CVE-2020-15711 (Other, published 2020-07-14T13:15Z)
Description: value: In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/AppController.php
app/View/Elements/global_menu.ctp
app/View/Layouts/default.ctp
app/webroot/js/misp.js
Commit message: fix: [security] setting a favourite homepage was not CSRF protected

- a user could be lured into setting a MISP home-page outside of the MISP baseurl
- switched the endpoint to be CSRF protection enabled

- as discovered by Mislav Božičević <mislav.bozicevic@nn.cz>


Vulnerable code:
    private $__queryVersion = '106';
                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP"></span>',
                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : ''
        type: 'POST',
        data: {
            path: window.location.pathname
        },
            showMessage('success', 'Homepage set.');
            $('#setHomePage').addClass('orange');
        },

Fixed code:
    private $__queryVersion = '107';
                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP" data-current-page="%s"></span>',
                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : '',
                    $this->here
    <div id = "ajax_hidden_container" class="hidden"></div>
        type: 'GET',
            $('#ajax_hidden_container').html(data);
            var currentPage = $('#setHomePage').data('current-page');
            $('#UserSettingPath').val(currentPage);
            $.ajax({
                type: 'POST',
                url: baseurl + '/userSettings/setHomePage',
                data: $('#UserSettingSetHomePageForm').serialize(),
                success:function (data, textStatus) {
                    showMessage('success', 'Homepage set.');
                    $('#setHomePage').addClass('orange');
                },
            });

        }
CVE-2020-25766 (Other, published 2020-09-18T18:15Z)
Description: value: An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Users/login.ctp
Commit message: fix: [users] Avoid POSTing forms not linked to the login page resulting in unwanted actions

- As reported by Michael Kerscher


Vulnerable code:
            var formHTML = $(html).find('form')

Fixed code:
            var formHTML = $(html).find('form#UserLoginForm')
            if (!formHTML.length) {
                window.location = baseurl + '/users/login'
            }
CVE-2020-28043 (PHP, published 2020-11-02T21:15Z)
Description: value: MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/ServersController.php
app/Model/Server.php
Commit message: fix: [security] SSRF fixed in the rest client

- by using the full path parameter in the rest client, users could issue queries to any server
- this becomes especially problematic when the MISP server is able to query other internal servers,
  as external users could trigger those

- new server setting added that allows enabling the full path option, this is now disabled by default
- new server setting added to add an override baseurl for the rest client, removing the need for the full
  path option in the first place (for example for the training VM with its port forwarding)

- Thanks to Heitor Gouvêa for reporting this vulnerability


Vulnerable code:
            'use_full_path' => $request['use_full_path'],
            if (empty($request['use_full_path'])) {
                $url = Configure::read('MISP.baseurl') . $path;

Fixed code:
            'use_full_path' => empty($request['use_full_path']) ? false : $request['use_full_path'],
            if (empty($request['use_full_path']) || empty(Configure::read('Security.rest_client_enable_arbitrary_urls'))) {
                $url = empty(Configure::read('Security.rest_client_baseurl')) ? (Configure::read('MISP.baseurl') . $path) : (Configure::read('Security.rest_client_baseurl') . $path);
        $view_data['url'] = $url;
                        'rest_client_enable_arbitrary_urls' => array(
                            'level' => 0,
                            'description' => __('Enable this setting if you wish for users to be able to query any arbitrary URL via the rest client. Keep in mind that queries are executed by the MISP server, so internal IPs in your MISP\'s network may be reachable.'),
                            'value' => false,
                            'errorMessage' => '',
                            'test' => 'testBool',
                            'type' => 'boolean',
                            'null' => true
                        ),
                        'rest_client_baseurl' => array(
                            'level' => 1,
                            'description' => __('If left empty, the baseurl of your MISP is used. However, in some instances (such as port-forwarded VM installations) this will not work. You can override the baseurl with a url through which your MISP can reach itself (typically https://127.0.0.1 would work).'),
                            'value' => false,
                            'errorMessage' => '',
                            'test' => null,
                            'type' => 'string',
                        ),
CVE-2020-28947 (PHP, published 2020-11-19T18:15Z)
Description: value: In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/TemplateElementsController.php
app/Model/Template.php
app/View/TemplateElements/ajax/ajaxIndex.ctp
Commit message: fix: [security] XSS in the template element index view
- As reported by Rubin Azad


Vulnerable code:

            throw new MethodNotAllowedException('No template with the provided ID exists, or you are not authorised to see it.');
        //if the user is a site admin, return the template withoug question
    <div id="AddTemplateElementDiv" role="button" tabindex="0" aria-label="<?php echo __('Add a new template element');?>" title="<?php echo __('Add a new template element');?>" class="addTemplateElement useCursorPointer" onClick="templateAddElementClicked(<?php echo $id; ?>);">+</div>

Fixed code:
        if (!is_numeric($id)) {
            throw new MethodNotAllowedException(__('No template with the provided ID exists, or you are not authorised to see it.'));
        }
            throw new MethodNotAllowedException(__('No template with the provided ID exists, or you are not authorised to see it.'));
        //if the user is a site admin, return the template without question
    <div id="AddTemplateElementDiv" role="button" tabindex="0" aria-label="<?php echo __('Add a new template element');?>" title="<?php echo __('Add a new template element');?>" class="addTemplateElement useCursorPointer" onClick="templateAddElementClicked(<?php echo h($id); ?>);">+</div>
CVE-2020-29006 (PHP, published 2020-11-24T15:15Z)
Description: value: MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/GalaxyElementsController.php
app/Model/GalaxyElement.php
Commit message: fix: [security] Make cluster's elements adhere to ACL


Vulnerable code:
    public function index($id)
        $this->paginate['conditions'] = array('GalaxyElement.galaxy_cluster_id' => $id);

Fixed code:
    public function index($clusterId)
        $aclConditions = $this->GalaxyElement->buildClusterConditions($this->Auth->user(), $clusterId);
        $this->paginate['conditions'] = [$aclConditions];
        $this->paginate['contain'] = ['GalaxyCluster' => ['fields' => ['id', 'distribution', 'org_id']]];

    public function buildACLConditions($user)
    {
        $conditions = [];
        if (!$user['Role']['perm_site_admin']) {
            $conditions = $this->GalaxyCluster->buildConditions($user);
        }
        return $conditions;
    }

    public function buildClusterConditions($user, $clusterId)
    {
        return [
            $this->buildACLConditions($user),
            'GalaxyCluster.id' => $clusterId
        ];
    }

    public function fetchElements(array $user, $clusterId)
    {
        $params = array(
            'conditions' => $this->buildClusterConditions($user, $clusterId),
            'contain' => ['GalaxyCluster' => ['fields' => ['id', 'distribution', 'org_id']]],
            'recursive' => -1
        );
        $elements = $this->find('all', $params);
        foreach ($elements as $i => $element) {
            $elements[$i] = $elements[$i]['GalaxyElement'];
            unset($elements[$i]['GalaxyCluster']);
            unset($elements[$i]['GalaxyElement']);
        }
        return $elements;
    }
CVE-2020-29572 (Other, published 2020-12-06T00:15Z)
Description: value: app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
Commit message: fix: [security] XSS in authkey comment field


Vulnerable code:
    $string = empty($value[0]) ? '' : $value[0];

Fixed code:
    $string = empty($value[0]) ? '' : h($value[0]);
CVE-2020-8890 (PHP, published 2020-02-12T00:15Z)
Description: value: An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-367 \u2014 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/UsersController.php
app/Model/Bruteforce.php
Commit message: fix: [security] Further fixes to the bruteforce handling

- resolved a potential failure of the subsystem when the MySQL and the webserver time settings are diverged
  - as reported by Dawid Czarnecki
- several tightenings of the checks to avoid potential foul play


Vulnerable code:
            if ($this->request->is('post')) {
        $expire = time() + Configure::read('SecureAuth.expire');
            'username' => $username,
            $title .= 'This has tripped the bruteforce protection after  ' . Configure::read('SecureAuth.amount') . ' failed attempts. The user is now blacklisted for ' . Configure::read('SecureAuth.expire') . ' seconds.';
            $sql = 'DELETE FROM bruteforces WHERE `expire` <= NOW();';
            $sql = 'DELETE FROM bruteforces WHERE expire <= NOW();';

Fixed code:
                    $expire = Configure::check('SecureAuth.expire') ? Configure::read('SecureAuth.expire') : 300;
            if ($this->request->is('post') || $this->request->is('put')) {
        $expire = Configure::check('SecureAuth.expire') ? Configure::read('SecureAuth.expire') : 300;
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        $expire = time() + $expire;
            'username' => trim(strtolower($username)),
            $title .= 'This has tripped the bruteforce protection after  ' . $amount . ' failed attempts. The user is now blacklisted for ' . $expire . ' seconds.';
        $expire = date('Y-m-d H:i:s', time());
            $sql = 'DELETE FROM bruteforces WHERE `expire` <= "' . $expire . '";';
            $sql = 'DELETE FROM bruteforces WHERE expire <= "' . $expire . '";';
CVE-2020-8890 (PHP, published 2020-02-12T00:15Z)
Description: value: An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-367 \u2014 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Bruteforce.php
Commit message: fix: [security] brutefoce protection rules tightened

- as reported by Dawid Czarnecki


Vulnerable code:
        $params = array('conditions' => array(
                        'Bruteforce.ip' => $ip,
                        'Bruteforce.username' => $username),);
        if ($count >= Configure::read('SecureAuth.amount')) {

Fixed code:
        $params = array(
            'conditions' => array(
            'Bruteforce.ip' => $ip,
            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
        );
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        if ($count >= $amount) {