CVE-2022-48328 (published 2023-02-20T04:15Z)

app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2022-12-22 13:11:57+01:00
msg: chg: [cleanup] indexfilter unused leftover functionality reworked
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: IndexFilterComponent.php
change_type: ModificationType.MODIFY
diff: @@ -44,15 +44,9 @@ class IndexFilterComponent extends Component
                 }
             }
         }
+
         if (!empty($paramArray)) {
             foreach ($paramArray as $p) {
-                if (
-                    isset($options['ordered_url_params'][$p]) &&
-                    (!in_array(strtolower((string)$options['ordered_url_params'][$p]), array('null', '0', false, 'false', null)))
-                ) {
-                    $data[$p] = $options['ordered_url_params'][$p];
-                    $data[$p] = str_replace(';', ':', $data[$p]);
-                }
                 if (isset($request->params['named'][$p])) {
                     $data[$p] = str_replace(';', ':', $request->params['named'][$p]);
                 }
@@ -67,26 +61,11 @@ class IndexFilterComponent extends Component
             }
         }
         unset($v);
-        if (!empty($options['additional_delimiters'])) {
-            if (!is_array($options['additional_delimiters'])) {
-                $options['additional_delimiters'] = array($options['additional_delimiters']);
-            }
-            foreach ($data as $k => $v) {
-                $found = false;
-                foreach ($options['additional_delimiters'] as $delim) {
-                    if (strpos($v, $delim) !== false) {
-                        $found = true;
-                        break;
-                    }
-                }
-                if ($found) {
-                    $data[$k] = explode($options['additional_delimiters'][0], str_replace($options['additional_delimiters'], $options['additional_delimiters'][0], $v));
-                    foreach ($data[$k] as $k2 => $value) {
-                        $data[$k][$k2] = trim($data[$k][$k2]);
-                    }
-                }
-            }
-        }
+        
+        $data = array_filter($data, function($paramName) use ($paramArray) {
+            return !empty($paramArray[$paramName]);
+        }, ARRAY_FILTER_USE_KEY);
+
         $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
         return $data;
     }

programming_language: PHP
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2022-12-22 15:35:30+01:00
msg: chg: [runaway function] split into easier to comprehend ones
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: IndexFilterComponent.php
change_type: ModificationType.MODIFY
diff: @@ -45,6 +45,18 @@ class IndexFilterComponent extends Component
             }
         }
 
+        $data = $this->__massageData($data, $request, $paramArray);
+
+        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
+        return $data;
+    }
+
+    private function __massageData($data, $request, $paramArray)
+    {
+        $data = array_filter($data, function($paramName) use ($paramArray) {
+            return !empty($paramArray[$paramName]);
+        }, ARRAY_FILTER_USE_KEY);
+
         if (!empty($paramArray)) {
             foreach ($paramArray as $p) {
                 if (isset($request->params['named'][$p])) {
@@ -61,13 +73,8 @@ class IndexFilterComponent extends Component
             }
         }
         unset($v);
-        
-        $data = array_filter($data, function($paramName) use ($paramArray) {
-            return !empty($paramArray[$paramName]);
-        }, ARRAY_FILTER_USE_KEY);
-
-        $this->Controller->set('passedArgs', json_encode($this->Controller->passedArgs));
         return $data;
+
     }
 
     public function isRest()

programming_language: PHP