Information disclosure in misp-project MISP

1) Information disclosure

EUVDB-ID: #VU30317

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11458

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote privileged user to gain access to sensitive information.

app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.

Mitigation

Install update from vendor's website.

Vulnerable software versions

MISP: 2.4.0 - 2.4.123

External links

http://github.com/MISP/MISP/commit/30ff4b6451549dae7b526d4fb3a49061311ed477
http://matthias.sdfeu.org/misp-poc.py

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.