Full Report
MISP security advisory (AV26-775)
Analysis Summary
# Vulnerability: Multiple Security Flaws in MISP cti-transmute
## CVE Details
- **CVE ID:** Not explicitly assigned in the advisory (Referenced by commit hashes)
- **CVSS Score:** N/A (Estimated High based on technical impact)
- **CWE:**
- CWE-918: Server-Side Request Forgery (SSRF)
- CWE-352: Cross-Site Request Forgery (CSRF)
- CWE-400: Uncontrolled Resource Consumption
## Affected Systems
- **Products:** MISP cti-transmute (Threat Intelligence transmutation tool)
- **Versions:** Prior to or equal to 1.4.0
- **Configurations:** Web-based interface and PDF report generation modules.
## Vulnerability Description
Three distinct security flaws were addressed in this advisory:
1. **Insecure PDF Rendering:** The application allowed file and network fetches during the evaluation of PDF reports. This could lead to local file disclosure or Server-Side Request Forgery (SSRF).
2. **Missing Request Validation:** The user deletion function lacked proper HTTP method enforcement, allowing actions via non-state-changing methods (likely GET), which facilitates Cross-Site Request Forgery (CSRF).
3. **Resource Exhaustion:** The `activity-timeline` feature lacked a cap on the day range, potentially allowing an attacker to trigger high CPU/Memory consumption by requesting massive datasets.
## Exploitation
- **Status:** Not exploited (Patches released via GitHub commits)
- **Complexity:** Low to Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Potential access to local files and internal network resources via PDF renderer)
- **Integrity:** High (Unauthorized deletion of user accounts via CSRF)
- **Availability:** Medium (Potential Denial of Service via resource-heavy timeline queries)
## Remediation
### Patches
Users should update to the latest version of **cti-transmute** or manually apply the following security commits:
- **Block file/network fetches in PDF:** [Commit 20f3530](https://github[.]com/MISP/cti-transmute/commit/20f35307bcb706c8dd8ca3884a88fb36b05b5244)
- **Cap activity-timeline range:** [Commit 321892d](https://github[.]com/MISP/cti-transmute/commit/321892d26b82c8a5af1e210ee30735abb109fac2)
- **Enforce POST for user deletion:** [Commit 4f0d051](https://github[.]com/MISP/cti-transmute/commit/4f0d051ec5f1d45894c26987d409411728b2d82c)
### Workarounds
- Restrict network access to the cti-transmute web interface to trusted users only.
- Disable PDF report generation if not strictly required until patches are applied.
## Detection
- Monitor web server logs for suspicious `GET` requests targeting user deletion endpoints.
- Monitor for unusually large date-range queries in the `activity-timeline` logs.
- Audit PDF generation logs for attempts to access `file://` or internal IP addresses.
## References
- [Canadian Centre for Cyber Security Advisory (AV26-775)](https://www[.]cyber[.]gc[.]ca/en/alerts-advisories/misp-security-advisory-av26-775)
- [MISP cti-transmute Repository](https://github[.]com/MISP/cti-transmute)