Privilege Escalation in MISP Event Sharing Group

Compliance Impact

This vulnerability allows an authenticated user with event edit permissions to assign an event to a sharing group they are not authorized to use, potentially leading to unauthorized disclosure of sensitive information.

Such unauthorized disclosure and modification of event distribution metadata could impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to and sharing of sensitive data.

By enabling unauthorized sharing group assignment, the vulnerability may lead to breaches of confidentiality and improper data handling, which are critical compliance concerns under these standards.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in MISP's non-REST event editing path, where an authenticated user with event edit permissions can manipulate the submitted form data to set an event's sharing_group_id to a sharing group they are not authorized to use.

Specifically, when the event distribution is set to sharing group distribution, the non-REST save path does not perform the same authorization checks as the REST edit path, allowing unauthorized assignment of events to restricted sharing groups.

An attacker can exploit this by tampering with the event edit request to assign an event to an undisclosed or unauthorized sharing group, potentially leading to unauthorized use of restricted sharing groups and unintended modification of event distribution metadata.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to assign events to sharing groups they should not have access to.

This could result in unauthorized disclosure of restricted sharing group names in event listings and unintended changes to the event's distribution metadata.

Such unauthorized access and modifications could compromise the confidentiality and integrity of shared information within MISP.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the MISP instance is updated to a version where the issue is fixed.

The fix involves validating that the selected sharing group can be used by the current user when the sharing group is changed, and clearing sharing_group_id when the event distribution is not set to sharing group distribution.

Useful 0 Not Useful 0