Executive Summary

This vulnerability is an information disclosure issue in the MISP AuthKey edit functionality. When an authenticated user with permission to edit an AuthKey submits an edit request that causes a validation error, the system incorrectly uses the attacker-controlled user_id value from the request to populate a user dropdown. This allows the attacker to submit arbitrary user IDs and see the corresponding dropdown data, enabling them to enumerate user email addresses.

The root cause is that the dropdown user list is derived from the submitted request data instead of the persisted AuthKey owner. The issue is fixed by changing the dropdown to use the stored AuthKey owner information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated user with edit permissions to enumerate user email addresses within the system. This information disclosure could be leveraged for further attacks such as phishing, social engineering, or targeted attacks against users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the MISP AuthKey edit functionality is updated to the fixed version where the dropdown user is derived from the persisted AuthKey owner instead of the request body.

Additionally, restrict permissions so that only trusted authenticated users have the ability to edit AuthKeys, minimizing the risk of exploitation.

Useful 0 Not Useful 0