CVE-2020-11458 (PHP, published 2020-04-02T12:15Z)
Description: value: app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/FeedsController.php
app/Model/Feed.php
app/Model/Server.php
app/View/Feeds/add.ctp
app/View/Feeds/edit.ctp
Commit message: chg: [security] Added setting to restrict the encoding of local feeds

- By adding local feeds, a malicious administrator could point MISP to ingest configuration files that the apache user has access to
- This includes some more sensitive files (database.php / config.php / .gnupg data)
- Whilst this is currently not leading to an exploitable vulnerability as the current implementation wouldn't trigger on the values,
  having a setting to disable this will become much more interesting once we have a system in place for custom feed parsers
- The setting can only be enabled/disabled via the CLI

- As reported by Matthias Weckbecker


Vulnerable code:
                    $message = __('Feed could not be added. Invalid field: %s', array_keys($this->Feed->validationErrors)[0]);
                $message = __('Feed could not be updated. Invalid fields: %s', implode(', ', array_keys($this->Feed->validationErrors)));
        <p><?php echo __('Add a new MISP feed source.');?></p>
    <?php
        echo $this->Form->input('enabled', array());
        echo $this->Form->input('caching_enabled', array('label' => __('Caching enabled')));
                'options' => array('network' => 'Network', 'local' => 'Local'),
        <p><?php echo __('Edit a new MISP feed source.');?></p>
    <?php
                    'options' => array('network' => 'Network', 'local' => 'Local'),

Fixed code:
                    $message = __('Feed could not be added. Reason: %s', json_encode($this->Feed->validationErrors));
                $message = __('Feed could not be updated. Reason: %s', json_encode($this->Feed->validationErrors));
        ),
        'input_source' => array(
            'rule' => 'validateInputSource',
            'message' => ''
    public function validateInputSource($fields)
    {
        if (!empty($this->data['Feed']['input_source'])) {
            $localAllowed = empty(Configure::read('Security.disable_local_feed_access'));
            $validOptions = array('network');
            if ($localAllowed) {
                $validOptions[] = 'local';
            }
            if (!in_array($this->data['Feed']['input_source'], $validOptions)) {
                return __(
                    'Invalid input source. The only valid options are %s. %s',
                    implode(', ', $validOptions),
                    (!$localAllowed && $this->data['Feed']['input_source'] === 'local') ?
                    __('Security.disable_local_feed_access is currently enabled, local feeds are thereby not allowed.') :
                    ''
                );
            }
        }
        return true;
    }

                        'disable_local_feed_access' => array(
                                'level' => 0,
                                'description' => __('Disabling this setting will allow the creation/modification of local feeds (as opposed to network feeds). Enabling this setting will restrict feed sources to be network based only. When disabled, keep in mind that a malicious site administrator could get access to any arbitrary file on the system that the apache user has access to. Make sure that proper safe-guards are in place. This setting can only be modified via the CLI.'),
                                'value' => false,
                                'errorMessage' => '',
                                'test' => 'testBool',
                                'type' => 'boolean',
                                'null' => true,
                                'cli_only' => 1
                        ),
        <?php
            if (!empty(Configure::read('Security.disable_local_feed_access'))) {
                echo sprintf(
                    '<p class="red bold">%s</p>',
                    __('Warning: local feeds are currently disabled by policy, to re-enable the feature, set the Security.allow_local_feed_access flag in the server settings. This setting can only be set via the CLI.')
                );
            }
            echo '<p>' . __('Add a new MISP feed source.') . '</p>';
            echo $this->Form->input('enabled', array());
            echo $this->Form->input('caching_enabled', array('label' => __('Caching enabled')));
        $options = array('network' => 'Network');
        if (empty(Configure::read('Security.disable_local_feed_access'))) {
            $options['local'] = 'Local';
        }
                'options' => $options,
        <?php
            if (!empty(Configure::read('Security.disable_local_feed_access'))) {
                echo sprintf(
                    '<p class="red bold">%s</p>',
                    __('Warning: local feeds are currently disabled by policy, to re-enable the feature, set the Security.allow_local_feed_access flag in the server settings. This setting can only be set via the CLI.')
                );
            }
            echo '<p>' . __('Edit a new MISP feed source.') . '</p>';
            $options = array('network' => 'Network');
            if (empty(Configure::read('Security.disable_local_feed_access'))) {
                $options['local'] = 'Local';
            }
                    'options' => $options,