Information Disclosure in MISP AuthKey Edit Functionality

Executive Summary

This vulnerability is an information disclosure issue in the MISP AuthKey edit functionality. When an authenticated user with permission to edit an AuthKey submits an edit request that causes a validation error, the system incorrectly uses the attacker-controlled user_id value from the request to populate a user dropdown. This allows the attacker to submit arbitrary user IDs and see the corresponding dropdown data, enabling them to enumerate user email addresses.

The root cause is that the dropdown user list is derived from the submitted request data instead of the persisted AuthKey owner. The issue is fixed by changing the dropdown to use the stored AuthKey owner information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated user with edit permissions to enumerate user email addresses within the system. This information disclosure could be leveraged for further attacks such as phishing, social engineering, or targeted attacks against users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the MISP AuthKey edit functionality is updated to the fixed version where the dropdown user is derived from the persisted AuthKey owner instead of the request body.

Additionally, restrict permissions so that only trusted authenticated users have the ability to edit AuthKeys, minimizing the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with permission to edit an AuthKey to enumerate user email addresses by submitting arbitrary user IDs and observing the returned dropdown data. Such unauthorized disclosure of user email addresses can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and disclosure.

Therefore, this information disclosure vulnerability could negatively impact compliance with standards and regulations that mandate strict controls on personal data confidentiality.

Useful 0 Not Useful 0