Full Report
MISP security advisory (AV26-901)
Analysis Summary
# Vulnerability: MISP Unauthorized Sharing Group Authorization
## CVE Details
- **CVE ID:** Not explicitly listed in the advisory (Referenced by Commit ID: 9b1363955)
- **CVSS Score:** Not Rated (Assumed Medium/High based on impact type)
- **CWE:** CWE-285: Improper Authorization
## Affected Systems
- **Products:** MISP (Malware Information Sharing Platform)
- **Versions:** Prior to or equal to version 2.5.45
- **Configurations:** Systems utilizing "Sharing Groups" for data distribution and access control.
## Vulnerability Description
A flaw exists in the authorization logic of MISP regarding how sharing groups are processed during submission. The vulnerability appears to allow for the authorization of a sharing group whenever one is submitted, potentially bypassing intended access controls or administrative review requirements. This could lead to sensitive threat intelligence being shared with unauthorized parties or groups without proper validation from the data owner.
## Exploitation
- **Status:** Vulnerability confirmed by vendor patch; exploitation in the wild not reported in this advisory.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Potential unauthorized disclosure of sensitive threat data to unintended sharing groups)
- **Integrity:** Medium (Potential unauthorized modification of distribution settings)
- **Availability:** Low
## Remediation
### Patches
- Users are encouraged to update to a version containing the fix identified in GitHub commit **9b1363955**.
- It is recommended to update to the latest stable release (greater than 2.5.45).
### Workarounds
- Review and audit all active "Sharing Groups" and their memberships.
- Restrict permissions for users who are authorized to create or modify sharing groups until the patch is applied.
## Detection
- **Indicators of Compromise:** Review MISP audit logs for unexpected additions to sharing groups or modifications to distribution settings by non-administrative users.
- **Detection methods and tools:** Monitor GitHub commit history for the specific repository to ensure the fix is integrated into your deployment branch.
## References
- **Vendor Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/misp-security-advisory-av26-901
- **Source Code Fix:** hxxps[://]github[.]com/MISP/MISP/commit/9b1363955