CyberRota Analysis
AI-GeneratedMISP is vulnerable due to a mass assignment flaw in its event delegation feature, allowing authenticated users with delegation permissions to manipulate delegation requests by injecting unauthorized fields like primary keys and event IDs. This vulnerability can lead to unauthorized read access to arbitrary events across different organizations and the potential overwriting of existing delegation records, compromising both confidentiality and integrity. Organizations using MISP versions prior to 2.5.48 should prioritize patching this issue to mitigate the risk of unauthorized data exposure and event ownership transfer.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id. An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted. Preconditions: - An authenticated user with the delegation permission (perm_delegate) - The MISP.delegation server setting must be enabled Impact: - Confidentiality: read access to any event on the instance - Integrity: overwriting existing delegation records and transferring event ownership Affected versions: MISP < 2.5.48