Vulnerability: When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.
Vulnerability ID: CVE-2017-14337
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/MISP/MISP
Published: 2017-09-12
File: app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php
Commit message: fix: Fix to certauth pains
Commit author: iglocska

Vulnerable version (before fix):
 public function getUser(CakeRequest $request) 				// If $sync is true, allow the creation of the user from the certificate 				$sync = Configure::read('CertAuth.syncUser'); 				if ($sync) { 					self::getRestUser(); 				}  				// find and fill user with model 				$userModelKey = empty(Configure::read('CertAuth.userModelKey')) ? 'email' : Configure::read('CertAuth.userModelKey'); 				$userDefaults = Configure::read('CertAuth.userDefaults'); 				$this->User = ClassRegistry::init('User'); 				$existingUser = $this->User->find('first', array( 					'conditions' => array($userModelKey => self::$user[$userModelKey]), 					'recursive' => false 				)); 				if ($existingUser) { 					if ($sync) { 						if (!isset(self::$user['org_id']) && isset(self::$user['org'])) {

Fixed version (after fix):
 public function getUser(CakeRequest $request) 				// If $sync is true, allow the creation of the user from the certificate 				$sync = Configure::read('CertAuth.syncUser'); 				if ($sync) { 					if (!self::getRestUser()) return false; 				}  				// find and fill user with model 				$userModelKey = empty(Configure::read('CertAuth.userModelKey')) ? 'email' : Configure::read('CertAuth.userModelKey'); 				$userDefaults = Configure::read('CertAuth.userDefaults'); 				$this->User = ClassRegistry::init('User'); 				if (!empty(self::$user[$userModelKey])) { 					$existingUser = $this->User->find('first', array( 						'conditions' => array($userModelKey => self::$user[$userModelKey]), 						'recursive' => false 					)); 				} 				if ($existingUser) { 					if ($sync) { 						if (!isset(self::$user['org_id']) && isset(self::$user['org'])) {

Patch:
patch: @@ -133,17 +133,19 @@ public function getUser(CakeRequest $request)
 				// If $sync is true, allow the creation of the user from the certificate
 				$sync = Configure::read('CertAuth.syncUser');
 				if ($sync) {
-					self::getRestUser();
+					if (!self::getRestUser()) return false;
 				}
 
 				// find and fill user with model
 				$userModelKey = empty(Configure::read('CertAuth.userModelKey')) ? 'email' : Configure::read('CertAuth.userModelKey');
 				$userDefaults = Configure::read('CertAuth.userDefaults');
 				$this->User = ClassRegistry::init('User');
-				$existingUser = $this->User->find('first', array(
-					'conditions' => array($userModelKey => self::$user[$userModelKey]),
-					'recursive' => false
-				));
+				if (!empty(self::$user[$userModelKey])) {
+					$existingUser = $this->User->find('first', array(
+						'conditions' => array($userModelKey => self::$user[$userModelKey]),
+						'recursive' => false
+					));
+				}
 				if ($existingUser) {
 					if ($sync) {
 						if (!isset(self::$user['org_id']) && isset(self::$user['org'])) {
path: app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php