Executive Summary

This vulnerability in MISP Core involves broken access-control checks in the bulk deletion processes for Event Reports and Sharing Groups.

For Event Reports, the deletion function used a broad global permission (perm_add) instead of verifying if the user was authorized to delete each specific report. This meant that a contributor-level user could delete reports belonging to other organizations.

For Sharing Groups, the bulk deletion function relied on a global sharing group permission rather than checking ownership of each sharing group. This allowed users with sharing group permissions to delete sharing groups owned by other organizations.

The vulnerability allowed authenticated users with certain broad permissions to delete objects outside their authorized scope, potentially causing loss of data across the instance.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized deletion of event reports and sharing groups that belong to other organizations within the MISP instance.

An attacker with contributor-level or sharing group permissions could abuse the bulk deletion endpoints to cause loss of important event-report content or sharing-group configurations across the entire instance.

This could disrupt collaboration, data integrity, and availability of shared threat intelligence information.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your MISP instance is updated with the patches that fix the broken access control in bulk deletion flows.

• For Event Reports, apply the fix that changes the deleteSelection handler to call EventReport::fetchIfAuthorized for each report, ensuring only authorized users can delete reports.
• For Sharing Groups, apply the fix that modifies the deleteSelection handler to call SharingGroup::checkIfOwner for each sharing group, enforcing ownership checks before deletion.

These fixes align bulk deletion authorization with the stricter single deletion controls, preventing users with broad role permissions from deleting objects outside their organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users with broad role permissions to delete event reports and sharing groups belonging to other organizations without proper authorization checks.

Such unauthorized deletions can lead to loss of sensitive data and breach of data integrity, which may violate compliance requirements under regulations like GDPR and HIPAA that mandate strict access controls and data protection.

By enabling cross-organization data deletion, the vulnerability undermines the principle of data segregation and accountability, potentially exposing organizations to regulatory penalties.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves broken access control in bulk deletion endpoints of MISP, allowing users with broad permissions to delete event reports or sharing groups outside their authorization scope.

To detect exploitation attempts on your system, you should monitor logs for bulk deletion requests to the EventReportsController::deleteSelection and SharingGroupsController::deleteSelection endpoints.

Specifically, look for authenticated users with contributor-level or sharing-group permissions performing bulk deletions of reports or sharing groups that do not belong to their organization.

Suggested commands to help detect suspicious activity include:

• Using grep or similar tools to search web server or application logs for bulk deletion API calls, e.g., `grep 'deleteSelection' /var/log/misp/application.log`
• Filtering logs for user IDs or roles with `perm_add` or sharing group permissions performing deletions on objects outside their organization.
• Using database queries to audit recent deletions and verify if deleted event reports or sharing groups belonged to the deleting user's organization.

Since the vulnerability is related to authorization checks in the application logic, network-level detection commands are limited; focus on application logs and audit trails.

Useful 0 Not Useful 0