CVE-2019-19379 (PHP, published 2019-11-28T17:15Z)
Description: value: In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/TagsController.php
Commit message: fix: [security] tightened checks for restricting users from tagging data they shouldn't be allowed to tag

As reported by Christophe Vandeplas


Vulnerable code:
    private function __findObjectByUuid($object_uuid, &$type)
        $object = $this->Event->find('first', array(
            'conditions' => array(
                'Event.uuid' => $object_uuid,
            ),
            'fields' => array('Event.orgc_id', 'Event.id'),
            'recursive' => -1
                !$this->userRole['perm_tagger'] &&
                $object['Event']['orgc_id'] != $this->Auth->user('org_id')
                throw new MethodNotAllowedException('Invalid Target.');
            $object = $this->Event->Attribute->find('first', array(
                'conditions' => array(
                    'Attribute.uuid' => $object_uuid,
                ),
                'fields' => array('Attribute.id'),
                'recursive' => -1,
                'contain' => array('Event.orgc_id')
            ));
                if (!$this->_isSiteAdmin() && !$this->userRole['perm_tagger'] && $object['Event']['orgc_id'] != $this->Auth->user('org_id')) {
                    throw new MethodNotAllowedException('Invalid Target.');
                throw new MethodNotAllowedException('Invalid Target.');
        if (!is_bool($local)) {
            throw new InvalidArgumentException('Invalid local flag');
        $object = $this->__findObjectByUuid($uuid, $objectType);
        $object = $this->__findObjectByUuid($uuid, $objectType);
            throw new MethodNotAllowedException('Invalid Target.');

Fixed code:
    private function __findObjectByUuid($object_uuid, &$type, $scope = 'modify')
        if (!$this->userRole['perm_tagger']) {
            throw new MethodNotAllowedException(__('This functionality requires tagging permission.'));
        }
        $object = $this->Event->fetchEvent($this->Auth->user(), array(
            'event_uuid' => $object_uuid,
            'metadata' => 1
            $object = $object[0];
                $scope !== 'view' &&
                !$object['Event']['orgc_id'] != $this->Auth->user('org_id')
                throw new MethodNotAllowedException(__('Invalid Target.'));
            $object = $this->Event->Attribute->fetchAttributes(
                $this->Auth->user(),
                array(
                    'conditions' => array(
                        'Attribute.uuid' => $object_uuid
                    ),
                    'flatten' => 1
                )
            );
                $object = $object[0];
                if (
                    $scope !== 'view' &&
                    !$this->_isSiteAdmin() &&
                    !$object['Event']['orgc_id'] != $this->Auth->user('org_id')
                ) {
                    throw new MethodNotAllowedException(__('Invalid Target.'));
                throw new MethodNotAllowedException(__('Invalid Target.'));
        if (!empty($local) && $this->Auth->user('org_id') != Configure::read('MISP.host_org_id')) {
            throw new MethodNotAllowedException(__('Local tags can only be added by users of the host organisation.'));
        $object = $this->__findObjectByUuid($uuid, $objectType, $local ? 'view' : 'modify');
        $object = $this->__findObjectByUuid($uuid, $objectType, 'view');
            throw new MethodNotAllowedException(__('Invalid Target.'));
        } else {
            if (empty($existingAssociation[$objectType . 'Tag']['local'])) {
                $object = $this->__findObjectByUuid($uuid, $objectType);
            } else {
                if ($object['Event']['orgc_id'] !== $this->Auth->user('org_id') && $this->Auth->user('org_id') != Configure::read('MISP.host_org_id')) {
                    throw new MethodNotAllowedException(__('Insufficient privileges to remove local tags from events you do not own.'));
                }
            }