Path Traversal in MISP via Organisation Logo Handling

Executive Summary

This vulnerability is a path traversal issue in the MISP application, specifically in the OrganisationsController::getOrgLogo function.

The problem arises because the code builds file paths for organisation logos using fields controlled by the organisation, such as id, name, and uuid, without properly ensuring that the resulting file path stays within the intended directory (APP/files/img/orgs/).

An attacker who can influence these organisation fields can use path traversal sequences (like ../) to trick the system into returning arbitrary readable .png or .svg files from outside the designated logo directory.

The vulnerability is fixed by using realpath() to resolve candidate paths and verifying that they remain under the expected base directory before serving the file.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to read arbitrary image files (.png or .svg) from the server outside the intended organisation logo directory.

By exploiting this, an attacker could potentially access sensitive files if such files are accessible and readable by the application, leading to information disclosure.

Since the vulnerability does not require user interaction and can be exploited remotely with low complexity, it poses a moderate risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the application resolves candidate file paths using realpath() and verifies that the resolved paths remain under the intended base directory before serving any files.

Additionally, restrict the ability of attackers to influence organisation-controlled fields such as id, name, and uuid that are used to build file paths.

Useful 0 Not Useful 0