CVE-2024-25675 (published 2024-02-09T09:15Z)

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: Sami Mokaddem
author_date: 2024-01-31 14:24:17+01:00
msg: fix: [security] Enforce usage of POST to start an export generation process

As reported by Andrei Agape / Teliacompany
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: JobsController.php
change_type: ModificationType.MODIFY
diff: @@ -154,6 +154,9 @@ class JobsController extends AppController
         if (Configure::read('MISP.disable_cached_exports')) {
             throw new MethodNotAllowedException('This feature is currently disabled');
         }
+        if (!$this->request->is('post')) {
+            throw new MethodNotAllowedException('This endpoint only accept POST.');
+        }
         if ($this->_isSiteAdmin()) {
             $target = 'All events.';
         } else {

programming_language: PHP
filename: export.ctp
change_type: ModificationType.MODIFY
diff: @@ -114,7 +114,7 @@
                         '<td><span class="btn-group">%s%s</span></td>',
                         ($k === 'text') ? '' : $this->Html->link(__('Download'), array('action' => 'downloadExport', $k), array('class' => 'btn btn-inverse btn-small')),
                         sprintf(
-                            '<button class="btn btn-inverse btn-small" id=button%s onClick="generate(\'%s\', \'%s\', \'%s\', \'%s\', \'%s\')" %s>%s</button>',
+                            '<button class="btn btn-inverse btn-small" id=button%s onClick="generate(\'%s\', \'%s\', \'%s\', \'%s\', \'%s\')" %s>%s</button><div class="hidden">%s</div>',
                             $i,
                             h($i),
                             h($k),
@@ -122,7 +122,8 @@
                             h($type['progress']),
                             h($type['lastModified']),
                             (!$type['recommendation']) ? 'disabled' : '',
-                            __('Generate')
+                            __('Generate'),
+                            $this->Form->postLink(__('Download'), array('controller' => 'jobs', 'action' => 'cache', h($k)), array('class' => 'btn btn-inverse btn-small')),
                         )
                     );
                 } else {
@@ -174,8 +175,12 @@
 ?>
 <script type="text/javascript">
     function generate(i, type, id, progress, modified) {
+        var $clicked = $('#button'+i)
+        var $form = $clicked.next().find('form')
         $.ajax({
-            url: "<?php echo $baseurl; ?>/jobs/cache/" + type,
+            url: $form.attr('action'),
+            type:'post',
+            data: $form.serialize()
             })
             .done(function(data) {
                 jobsArray[i] = data;

programming_language: PHP