CVE-2022-48329 (published 2023-02-20T04:15Z)

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2022-11-28 11:12:58+01:00
msg: chg: [rearrange parameters] improve the way we allow users to rearrange data

- tie more endpoints into the new findOrder() functionality
- allow for new context specific ordering rules
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: GalaxyCluster.php
change_type: ModificationType.MODIFY
diff: @@ -1063,8 +1063,12 @@ class GalaxyCluster extends AppModel
         if (isset($options['group'])) {
             $params['group'] = $options['group'];
         }
-        if (isset($options['order'])) {
-            $params['order'] = $options['order'];
+        if (!empty($options['order'])) {
+            $options['order'] = $this->findOrder(
+                $options['order'],
+                'GalaxyCluster',
+                ['id', 'event_id', 'version', 'type', 'value', 'distribution', 'orgc_id', 'org_id', 'tag_name', 'galaxy_id']
+            );
         }
         if (isset($options['page'])) {
             $params['page'] = $options['page'];

programming_language: PHP
filename: Workflow.php
change_type: ModificationType.MODIFY
diff: @@ -1156,9 +1156,16 @@ class Workflow extends AppModel
         if (isset($options['contain'])) {
             $params['contain'] = !empty($options['contain']) ? $options['contain'] : [];
         }
-        if (isset($options['order'])) {
-            $params['order'] = !empty($options['order']) ? $options['order'] : [];
+
+        $params['order'] = [];
+        if (!empty($options['order'])) {
+            $options['order'] = $this->findOrder(
+                $options['order'],
+                'Workflow',
+                ['id', 'name', 'timestmap', 'trigger_id', 'counter']
+            );
         }
+
         $workflows = $this->find('all', $params);
         return $workflows;
     }

programming_language: PHP
filename: LogableBehavior.php
change_type: ModificationType.MODIFY
diff: @@ -161,10 +161,17 @@ class LogableBehavior extends ModelBehavior {
 				'limit' => 50);
 		$params = array_merge($defaults, $params);
 		$options = array(
-				'order' => $params['order'],
 				'conditions' => $params['conditions'],
 				'fields' => $params['fields'],
-				'limit' => $params['limit']);
+				'limit' => $params['limit']
+		);
+		if (!empty($options['order'])) {
+			$options['order'] = $Model->findOrder(
+				$options['order'],
+				'Attribute',
+				['id', 'action', 'model_id', 'model', 'ip', 'org', 'email']
+			);
+		}
 		if ($params[$this->settings[$Model->alias]['classField']] === NULL) {
 			$params[$this->settings[$Model->alias]['classField']] = $Model->alias;
 		}

programming_language: PHP
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2022-11-28 11:05:34+01:00
msg: chg: [attribute] rearranging fixed
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: Attribute.php
change_type: ModificationType.MODIFY
diff: @@ -1705,7 +1705,14 @@ class Attribute extends AppModel
         if (empty($options['flatten'])) {
             $params['conditions']['AND'][] = array('Attribute.object_id' => 0);
         }
-        $params['order'] = isset($options['order']) ? $options['order'] : [];
+        $params['order'] = [];
+        if (!empty($options['order'])) {
+            $options['order'] = $this->findOrder(
+                $options['order'],
+                'Attribute',
+                ['id', 'event_id', 'object_id', 'type', 'category', 'value', 'distribution', 'timestamp', 'object_relation']
+            );
+        }
         if (!isset($options['withAttachments'])) {
             $options['withAttachments'] = false;
         }

programming_language: PHP