MISP Modulesの脆弱性で外部ツールのAPIキーが認証なしで取得される
Summary
MISP Modulesのwebサイト機能に脆弱性があり、認証なしで/external_tools/listにアクセスすると、外部ツールのAPIキーが取得できます。取得されたキーを使うと、MISPになりすましたり外部サービスに直接アクセスされたりするおそれがあります。影響するのは3.1.4以前のmisp-modulesです。修正版の有無は公開されている情報では確認できないため、最新の情報を確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
MISP Modulesのwebサイト機能に脆弱性があり、認証なしで/external_tools/listにアクセスすると、外部ツールのAPIキーが取得できます。取得されたキーを使うと、MISPになりすましたり外部サービスに直接アクセスされたりするおそれがあります。影響するのは3.1.4以前のmisp-modulesです。修正版の有無は公開されている情報では確認できないため、最新の情報を確認してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| mispmisp-modules |
≤ 3.1.4→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM.
The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services.
The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic.
Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html templat…
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com