Mitigation Strategies

To mitigate this vulnerability, ensure that the 'id' field is explicitly removed or unset from user-supplied data when creating new sharing groups in MISP.

This prevents the create() method from updating existing sharing groups and enforces proper access control.

Applying the fix from the referenced commit, which unsets the 'id' field before processing sharing group creation, is recommended.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a mass assignment issue in MISP's sharing group creation endpoint. When a new sharing group is created, the system did not remove a user-supplied 'id' field before saving the data. Because of how CakePHP handles save operations, providing a primary key in the input can cause the system to update an existing sharing group instead of creating a new one.

An authenticated user with permission to add sharing groups could exploit this by submitting the identifier of an existing sharing group, thereby modifying that group without passing the usual edit access-control checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to take over or alter sharing groups they do not have permission to edit. This unauthorized modification can compromise the confidentiality and integrity of the information shared within those groups.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with permission to add sharing groups to modify existing sharing groups without proper edit access-control checks. This can lead to unauthorized alteration or takeover of sharing groups, potentially compromising the confidentiality and integrity of information shared through those groups.

Such unauthorized access and modification of sensitive information could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.

Useful 0 Not Useful 0