CyberRota Analysis
AI-GeneratedThe cti-transmute application is vulnerable to a Server-Side Request Forgery (SSRF) in its /fetch_misp_event and /misp_search_events endpoints, allowing attackers to exploit the server to make requests to internal network addresses by supplying specially crafted domain names. This could lead to unauthorized access to sensitive internal resources and data. Organizations utilizing cti-transmute should prioritize patching this vulnerability to mitigate potential internal network exposure and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response. The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes.