Executive Summary

This vulnerability exists in MISP's non-REST event editing path, where an authenticated user with event edit permissions can manipulate the submitted form data to set an event's sharing_group_id to a sharing group they are not authorized to use.

Specifically, when the event distribution is set to sharing group distribution, the non-REST save path does not perform the same authorization checks as the REST edit path, allowing unauthorized assignment of events to restricted sharing groups.

An attacker can exploit this by tampering with the event edit request to assign an event to an undisclosed or unauthorized sharing group, potentially leading to unauthorized use of restricted sharing groups and unintended modification of event distribution metadata.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to assign events to sharing groups they should not have access to.

This could result in unauthorized disclosure of restricted sharing group names in event listings and unintended changes to the event's distribution metadata.

Such unauthorized access and modifications could compromise the confidentiality and integrity of shared information within MISP.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the MISP instance is updated to a version where the issue is fixed.

The fix involves validating that the selected sharing group can be used by the current user when the sharing group is changed, and clearing sharing_group_id when the event distribution is not set to sharing group distribution.

Useful 0 Not Useful 0