Executive Summary

This vulnerability exists because MISP has an insecure default configuration where the Security.check_sec_fetch_site_header control is disabled.

When this setting is disabled, state-changing requests like POST, PUT, or AJAX are not restricted based on the browser's Sec-Fetch-Site header.

A remote unauthenticated attacker can exploit this by crafting a malicious web page that causes an authenticated MISP user's browser to send cross-site requests to MISP automation endpoints.

If successful, these forged requests may be processed with the victim user's privileges, potentially allowing unauthorized modification of MISP data or configuration.

Enabling the Security.check_sec_fetch_site_header setting mitigates this issue, although multi-homed MISP deployments should validate this setting before enforcing it.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not explicitly address how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote attacker to perform unauthorized actions on behalf of an authenticated MISP user.

Specifically, the attacker can cause the victim's browser to send forged cross-site requests to MISP automation endpoints, which may be processed with the victim's privileges.

As a result, unauthorized modification of MISP data or configuration could occur, potentially compromising the integrity and security of the MISP instance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking whether the Security.check_sec_fetch_site_header setting is disabled in your MISP instance configuration. If this setting is disabled, your system is vulnerable to cross-site request forgery attacks via automation endpoints.

Administrators can look for warnings related to the Sec-Fetch-Site header in the MISP platform logs or configuration interface, as recent updates introduce alerts when this setting is disabled.

While no specific commands are provided, you can inspect the MISP configuration files or use commands to search for the setting, for example:

• grep -r 'check_sec_fetch_site_header' /path/to/misp/config/
• Check MISP logs for warnings about Sec-Fetch-Site header settings.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to enable the Security.check_sec_fetch_site_header setting in your MISP configuration. This setting restricts state-changing requests based on the browser-provided Sec-Fetch-Site header, preventing unauthorized cross-site requests.

Operators of multi-homed MISP deployments should validate this setting carefully before enforcing it, as enabling it may interfere with instances hosted across multiple addresses.

Enabling this setting will help protect against CSRF attacks targeting MISP automation endpoints.

Useful 0 Not Useful 0