hitoshura25/cvefixes huggingface dataset:
CVE-2022-27245 (PHP, published 2022-03-18T18:15Z)
Description: value: An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Server.php
Commit message: fix: [security] restrict setting to cli only. enabling this setting could allow potential ssrf attacks, as reported by Ianis BERNARD - NATO Cyber Security Centre


Vulnerable code:
                    'null' => true

Fixed code:
                    'null' => true,
                    'cli_only' => 1
CVE-2022-27246 (PHP, published 2022-03-18T18:15Z)
Description: value: An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Config/config.default.php
app/Controller/OrganisationsController.php
app/Model/Server.php
app/View/Organisations/admin_add.ctp
Commit message: new: add setting for allowing svg org logos


Vulnerable code:
                'label' => __('Logo (48×48 PNG or SVG)'),

Fixed code:
        'enable_svg_logos'                  => false,

            if ($extension === 'svg' && !Configure::read('Security.enable_svg_logos')) {
                $this->Flash->error(__('Invalid file extension, SVG images are not allowed.'));
                return false;
            }

                'enable_svg_logos' => [
                    'level' => self::SETTING_OPTIONAL,
                    'description' => __('When enabled, orgnisation logos in svg format are allowed.'),
                    'value' => false,
                    'test' => 'testBool',
                    'type' => 'boolean',
                    'null' => true
                ]
                'label' => __('Logo (48×48 %s)', Configure::read('Security.enable_svg_logos')? 'PNG or SVG' : 'PNG'),
CVE-2022-29528 (PHP, published 2022-04-20T23:15Z)
Description: value: An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/AppModel.php
Commit message: fix: [security] unregister phar from stream wrappers globally for all Model code

- blanket protection against phar deserialization vulnerabilities

- as reported by Dawid Czarnecki of Zigrin Security


Vulnerable code:

Fixed code:
        if (in_array('phar', stream_get_wrappers())) {
            stream_wrapper_unregister('phar');
        }
CVE-2022-29529 (Other, published 2022-04-20T23:15Z)
Description: value: An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Users/login.ctp
Commit message: fix: [security] XSS in LinOTP login field fixed

- fixed a stored XSS in the LinOTP login
- also fixed invalid calls to check MISP settings from a javascript scope

- as reported by Dawid Czarnecki of Zigrin Security


Vulnerable code:
                    Configure::read('LinOTPAuth.baseUrl'),
    if (!empty(Configure::read('LinOTPAuth')) && Configure::read('LinOTPAuth.enabled')) {
            if (!empty(Configure::read('LinOTPAuth')) && Configure::read('LinOTPAuth.enabled')) {

Fixed code:
                    h(Configure::read('LinOTPAuth.baseUrl')),
    var LinOTPAuth = <?= empty(Configure::read('LinOTPAuth')) ? 'False' : 'True' ?>;
    var LinOTPAuthEnabled = <?= empty(Configure::read('LinOTPAuth.enabled')) ? 'False' : 'True' ?>;

    if (LinOTPAuth && LinOTPAuthEnabled) {
            if (LinOTPAuth && LinOTPAuthEnabled) {
CVE-2022-29530 (Other, published 2022-04-20T23:15Z)
Description: value: An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/GalaxyClusters/view.ctp
Commit message: fix: [security] XSS in galaxy clusters

- fixed a stored XSS in the galaxy clusters

- as reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army


Vulnerable code:
        '<a href="' . $cluster['GalaxyCluster']['source'] . '" rel="noreferrer noopener">' . h($cluster['GalaxyCluster']['source']) :

Fixed code:
        '<a href="' . h($cluster['GalaxyCluster']['source']) . '" rel="noreferrer noopener">' . h($cluster['GalaxyCluster']['source']) :
CVE-2022-29532 (Other, published 2022-04-20T23:15Z)
Description: value: An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp
Commit message: fix: [security] XSS in cerebrate view

- low probability XSS in the cerebrate view's URL field
- a malicious administrator could set a javascript: url
- another administrator would have to click the suspicious looking URL to be affected

- As reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army


Vulnerable code:

Fixed code:
            $temp = explode(':', $field['url']);
            if (!in_array(strtolower($temp[0]), ['http', 'https'])) {
                $field['url'] = '#';
                $string = 'Malformed URL - invalid protocol (' . h($temp[0]) . ':)';
            }
CVE-2022-29533 (PHP, published 2022-04-20T23:15Z)
Description: value: An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/OrganisationsController.php
Commit message: fix: [security] low probability reflected XSS fixed

- User would need to navigate to a url that contains the payload
- user needs to click on a checkbox in a weird single checkbox page to trigger the exploit

- as reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army


Vulnerable code:
        $this->set('id', $id);

Fixed code:
        $this->set('id', (int)$id);
CVE-2022-29534 (PHP, published 2022-04-20T23:15Z)
Description: value: An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/UsersController.php
Commit message: fix: [security] Password confirmation bypass in user edit

- optional password confirmation can be potentially circumvented
- fooling the user edit via a request that sets accept:application/json whilst posting form content

- as reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army


Vulnerable code:
            if (!$abortPost && !$this->_isRest()) {
            if (!$this->_isRest()) {

Fixed code:
            if (!$abortPost && (!$this->_isRest() || empty($this->request->header('Authorization')))) {
            if (!$this->_isRest() || empty($this->request->header('Authorization'))) {
CVE-2022-42724 (PHP, published 2022-10-10T05:15Z)
Description: value: app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/UsersController.php
Commit message: security: [user] Fixing disclosure of roles name to non-site admin users and ensure user edit applies the restricted_to_site_admin option


This vulnerability with a default MISP installation without additional roles is disclosing list of role name which were restricted to the site admin. This commit fixes this disclosure vulnerability.

In addition for MISP installation with custom roles, an org admin user could create a user assigned to new custom roles which were restricted to site admin. This could lead to the access of complementary permissions (except site admin, org admin and sync actions).

Credits: CIRCL


Vulnerable code:
            $params = array('conditions' => array('perm_site_admin !=' => 1, 'perm_sync !=' => 1, 'perm_regexp_access !=' => 1));
                    if (empty($chosenRole) || (($chosenRole['Role']['id'] != $allowedRole) && ($chosenRole['Role']['perm_site_admin'] == 1 || $chosenRole['Role']['perm_regexp_access'] == 1 || $chosenRole['Role']['perm_sync'] == 1))) {

Fixed code:
            $params = array('conditions' => array('perm_site_admin !=' => 1, 'perm_sync !=' => 1, 'perm_regexp_access !=' => 1, 'restricted_to_site_admin' => 0));
                    if (
                        empty($chosenRole) ||
                        (
                            ($chosenRole['Role']['id'] != $allowedRole) && 
                            ($chosenRole['Role']['perm_site_admin'] == 1 ||
                            $chosenRole['Role']['perm_regexp_access'] == 1 ||
                            $chosenRole['Role']['perm_sync'] == 1) ||
                            $chosenRole['Role']['restricted_to_site_admin'] == 1
                        )
                    ) {
CVE-2022-47928 (Other, published 2022-12-22T23:15Z)
Description: value: In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Templates/upload_file.ctp
Commit message: fix: [security] XSS in the template file uploads

- as reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
    } else {
<span id="fileUploadButton_<?php echo $element_id; ?>"  role="button" tabindex="0" aria-label="<?php echo $buttonText; ?>" title="<?php echo $buttonText; ?>" class="btn btn-primary" onClick="templateFileUploadTriggerBrowse('<?php echo $element_id; ?>');"><?php echo $buttonText; ?></span>
    templateFileHiddenAdd(fileArray, '<?php echo $element_id; ?>', '<?php echo $batch; ?>');
    showMessage('<?php echo $upload_error ? 'fail' : 'success'; ?>', '<?php echo $result; ?>', 'iframe');

Fixed code:
    } else {    
<span id="fileUploadButton_<?php echo h($element_id); ?>"  role="button" tabindex="0" aria-label="<?php echo $buttonText; ?>" title="<?php echo $buttonText; ?>" class="btn btn-primary" onClick="templateFileUploadTriggerBrowse(<?php echo json_encode($element_id); ?>);"><?php echo $buttonText; ?></span>
    templateFileHiddenAdd(fileArray, '<?php echo h($element_id); ?>', '<?php echo h($batch); ?>');
    showMessage('<?php echo $upload_error ? 'fail' : 'success'; ?>', '<?php echo h($result); ?>', 'iframe');
CVE-2022-48328 (PHP, published 2023-02-20T04:15Z)
Description: value: app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/Component/IndexFilterComponent.php
Commit message: chg: [cleanup] indexfilter unused leftover functionality reworked


Vulnerable code:
                if (
                    isset($options['ordered_url_params'][$p]) &&
                    (!in_array(strtolower((string)$options['ordered_url_params'][$p]), array('null', '0', false, 'false', null)))
                ) {
                    $data[$p] = $options['ordered_url_params'][$p];
                    $data[$p] = str_replace(';', ':', $data[$p]);
                }
        if (!empty($options['additional_delimiters'])) {
            if (!is_array($options['additional_delimiters'])) {
                $options['additional_delimiters'] = array($options['additional_delimiters']);
            }
            foreach ($data as $k => $v) {
                $found = false;
                foreach ($options['additional_delimiters'] as $delim) {
                    if (strpos($v, $delim) !== false) {
                        $found = true;
                        break;
                    }
                }
                if ($found) {
                    $data[$k] = explode($options['additional_delimiters'][0], str_replace($options['additional_delimiters'], $options['additional_delimiters'][0], $v));
                    foreach ($data[$k] as $k2 => $value) {
                        $data[$k][$k2] = trim($data[$k][$k2]);
                    }
                }
            }
        }

Fixed code:

        
        $data = array_filter($data, function($paramName) use ($paramArray) {
            return !empty($paramArray[$paramName]);
        }, ARRAY_FILTER_USE_KEY);
CVE-2022-48328 (PHP, published 2023-02-20T04:15Z)
Description: value: app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/Component/IndexFilterComponent.php
Commit message: chg: [runaway function] split into easier to comprehend ones


Vulnerable code:
        
        $data = array_filter($data, function($paramName) use ($paramArray) {
            return !empty($paramArray[$paramName]);
        }, ARRAY_FILTER_USE_KEY);

        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));

Fixed code:
        $data = $this->__massageData($data, $request, $paramArray);

        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
        return $data;
    }

    private function __massageData($data, $request, $paramArray)
    {
        $data = array_filter($data, function($paramName) use ($paramArray) {
            return !empty($paramArray[$paramName]);
        }, ARRAY_FILTER_USE_KEY);
CVE-2022-48329 (PHP, published 2023-02-20T04:15Z)
Description: value: MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/GalaxyCluster.php
app/Model/Workflow.php
app/Plugin/Assets/models/behaviors/LogableBehavior.php
Commit message: chg: [rearrange parameters] improve the way we allow users to rearrange data

- tie more endpoints into the new findOrder() functionality
- allow for new context specific ordering rules


Vulnerable code:
        if (isset($options['order'])) {
            $params['order'] = $options['order'];
        if (isset($options['order'])) {
            $params['order'] = !empty($options['order']) ? $options['order'] : [];
				'order' => $params['order'],
				'limit' => $params['limit']);

Fixed code:
        if (!empty($options['order'])) {
            $options['order'] = $this->findOrder(
                $options['order'],
                'GalaxyCluster',
                ['id', 'event_id', 'version', 'type', 'value', 'distribution', 'orgc_id', 'org_id', 'tag_name', 'galaxy_id']
            );

        $params['order'] = [];
        if (!empty($options['order'])) {
            $options['order'] = $this->findOrder(
                $options['order'],
                'Workflow',
                ['id', 'name', 'timestmap', 'trigger_id', 'counter']
            );

				'limit' => $params['limit']
		);
		if (!empty($options['order'])) {
			$options['order'] = $Model->findOrder(
				$options['order'],
				'Attribute',
				['id', 'action', 'model_id', 'model', 'ip', 'org', 'email']
			);
		}
CVE-2022-48329 (PHP, published 2023-02-20T04:15Z)
Description: value: MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Attribute.php
Commit message: chg: [attribute] rearranging fixed


Vulnerable code:
        $params['order'] = isset($options['order']) ? $options['order'] : [];

Fixed code:
        $params['order'] = [];
        if (!empty($options['order'])) {
            $options['order'] = $this->findOrder(
                $options['order'],
                'Attribute',
                ['id', 'event_id', 'object_id', 'type', 'category', 'value', 'distribution', 'timestamp', 'object_relation']
            );
        }
CVE-2023-24026 (JavaScript, published 2023-01-20T22:15Z)
Description: value: In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/event-graph.js
Commit message: fix: [security] XSS in eventgraph preview payload

- as reported by Cyber Controls from SIX Group


Vulnerable code:
                        content: function() { return '<img style="width: 500px; height: 150px;" src="' + $(this).data('network-preview') + '" />'; },
                    content: function() { return '<img style="width: 500px; height: 150px;" src="' + $(this).data('network-preview') + '" />'; },

Fixed code:
                        content: function() { return '<img style="width: 500px; height: 150px;" src="' + $('<div>').text($(this).data('network-preview')).html() + '" />'; },
                    content: function() { return '<img style="width: 500px; height: 150px;" src="' + $('<div>').text($(this).data('network-preview')).html() + '" />'; },
CVE-2023-24027 (JavaScript, published 2023-01-20T22:15Z)
Description: value: In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/action_table.js
Commit message: fix: [security] XSS through network history name

- as reported by Cyber Controls from SIX Group


Vulnerable code:
            td.innerHTML = col;

Fixed code:
            td.textContent = col;
CVE-2023-24028 (PHP, published 2023-01-20T22:15Z)
Description: value: In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/Component/ACLComponent.php
Commit message: fix: [security] Prevent unauthorized access to decaying import function

- as reported by Cyber Controls from SIX Group


Vulnerable code:
                "import" => array('*'),

Fixed code:
                "import" => array('OR' => array('perm_admin', 'perm_decaying')),
CVE-2023-24070 (PHP, published 2023-01-23T05:15Z)
Description: value: app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/Component/CRUDComponent.php
app/View/AuthKeys/authkey_display.ctp
Commit message: fix: [security] XSS in authkey add

- as reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
                        $this->Controller->set('referer', $this->Controller->referer());
                <a href="<?= $referer ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
        <a href="<?= $referer ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>

Fixed code:
                        $this->Controller->set('referer', $this->Controller->referer(['action' => 'view', $model->id], true));
                <a href="<?= h($referer) ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
        <a href="<?= h($referer) ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>