Affected versions of MISP\u2019s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.<\/p>\n
The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:<\/p>\n
\u2003- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;
\n\u2003- feed detail access did not enforce the same host-organisation\/site-admin authorization as FeedsController::view();
\n\u2003- Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;
\n\u2003- server synchronization authkey values were not explicitly hidden from CLI detail output;
\n\u2003- sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();
\n\u2003- the use command could establish context for a record without first proving that the user was authorized to view that record<\/p>\n
The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization\/data-disclosure mismatch.<\/p>\n
Version affected: \u22642.5.45<\/p>\n","protected":false},"excerpt":{"rendered":"
Affected versions of MISP\u2019s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.<\/p>\n
The patch shows that CLI acce<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22203","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}