CVE-2020-15711 (published 2020-07-14T13:15Z)

In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2020-07-13 12:19:11+02:00
msg: fix: [security] setting a favourite homepage was not CSRF protected

- a user could be lured into setting a MISP home-page outside of the MISP baseurl
- switched the endpoint to be CSRF protection enabled

- as discovered by Mislav Božičević <mislav.bozicevic@nn.cz>
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: AppController.php
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,7 @@ class AppController extends Controller
 
     public $helpers = array('Utility', 'OrgImg', 'FontAwesome', 'UserName', 'DataPathCollector');
 
-    private $__queryVersion = '106';
+    private $__queryVersion = '107';
     public $pyMispVersion = '2.4.128';
     public $phpmin = '7.2';
     public $phprec = '7.4';

programming_language: PHP
filename: global_menu.ctp
change_type: ModificationType.MODIFY
diff: @@ -413,8 +413,9 @@
                 'type' => 'root',
                 'url' => '#',
                 'html' => sprintf(
-                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP"></span>',
-                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : ''
+                    '<span class="fas fa-star %s" id="setHomePage" title="Set the current page as your home page in MISP" data-current-page="%s"></span>',
+                    (!empty($homepage['path']) && $homepage['path'] === $this->here) ? 'orange' : '',
+                    $this->here
                 )
             ),
             array(

programming_language: PHP
filename: default.ctp
change_type: ModificationType.MODIFY
diff: @@ -88,6 +88,7 @@
     <div id = "ajax_fail_container" class="ajax_container">
         <div id="ajax_fail" class="ajax_result ajax_fail"></div>
     </div>
+    <div id = "ajax_hidden_container" class="hidden"></div>
     <div class="loading">
         <div class="spinner"></div>
         <div class="loadingText"><?php echo __('Loading');?></div>

programming_language: PHP
filename: misp.js
change_type: ModificationType.MODIFY
diff: @@ -5022,15 +5022,23 @@ function resetDashboardGrid(grid) {
 
 function setHomePage() {
     $.ajax({
-        type: 'POST',
+        type: 'GET',
         url: baseurl + '/userSettings/setHomePage',
-        data: {
-            path: window.location.pathname
-        },
         success:function (data, textStatus) {
-            showMessage('success', 'Homepage set.');
-            $('#setHomePage').addClass('orange');
-        },
+            $('#ajax_hidden_container').html(data);
+            var currentPage = $('#setHomePage').data('current-page');
+            $('#UserSettingPath').val(currentPage);
+            $.ajax({
+                type: 'POST',
+                url: baseurl + '/userSettings/setHomePage',
+                data: $('#UserSettingSetHomePageForm').serialize(),
+                success:function (data, textStatus) {
+                    showMessage('success', 'Homepage set.');
+                    $('#setHomePage').addClass('orange');
+                },
+            });
+
+        }
     });
 }
 

programming_language: JavaScript