CVE-2024-25675: MISP Auth Bypass Vulnerability

CVE-2024-25675 Overview

An HTTP method bypass vulnerability was discovered in MISP (Malware Information Sharing Platform) before version 2.4.184. The vulnerability exists in the export generation process where clients are not required to use POST requests, allowing potential abuse of the export functionality. This issue affects app/Controller/JobsController.php and app/View/Events/export.ctp.

Critical Impact

Attackers can bypass intended access controls by exploiting the missing HTTP method enforcement, potentially triggering export generation processes without proper request validation, leading to unauthorized data access or resource exhaustion.

Affected Products

• MISP versions prior to 2.4.184
• MISP app/Controller/JobsController.php component
• MISP app/View/Events/export.ctp component

Discovery Timeline

• 2024-02-09 - CVE-2024-25675 published to NVD
• 2025-06-16 - Last updated in NVD database

Technical Details for CVE-2024-25675

Vulnerability Analysis

This vulnerability falls under CWE-749 (Exposed Dangerous Method or Function), where the MISP application fails to properly enforce HTTP method restrictions on security-sensitive endpoints. The export generation functionality in JobsController.php did not validate that incoming requests used the POST method, allowing attackers to potentially trigger export operations via GET requests.

In web application security, enforcing proper HTTP methods is critical because GET requests can be cached, logged in server access logs, stored in browser history, and are more susceptible to Cross-Site Request Forgery (CSRF) attacks. By accepting GET requests for state-changing operations like export generation, the application exposes itself to various attack vectors including CSRF, unintended cache poisoning, and information disclosure through referrer headers.

Root Cause

The root cause lies in the missing HTTP method validation in the JobsController.php file. The cache function responsible for initiating export generation did not include a check to ensure the request method was POST before processing. This oversight allowed any HTTP method to trigger the export generation process, violating the principle of using POST for state-changing operations.

Attack Vector

The vulnerability is exploitable over the network without authentication (based on the CVSS vector), allowing remote attackers to craft malicious requests that bypass the intended POST-only restriction. An attacker could embed links in emails, forums, or malicious websites that, when clicked by an authenticated MISP user, would trigger export generation processes. This could lead to unauthorized access to exported data, denial of service through resource exhaustion, or information disclosure.

// Security patch in app/Controller/JobsController.php
// Source: https://github.com/MISP/MISP/commit/0ac2468c2896f4be4ef9219cfe02bff164411594

         if (Configure::read('MISP.disable_cached_exports')) {
             throw new MethodNotAllowedException('This feature is currently disabled');
         }
+        if (!$this->request->is('post')) {
+            throw new MethodNotAllowedException('This endpoint only accept POST.');
+        }
         if ($this->_isSiteAdmin()) {
             $target = 'All events.';
         } else {

Detection Methods for CVE-2024-25675

Indicators of Compromise

• Unusual GET requests to /jobs/cache/ or export-related endpoints in web server access logs
• High volume of export generation requests from single IP addresses or user sessions
• Unexpected export files being generated or accessed without corresponding POST request logs
• CSRF-like attack patterns where export endpoints are triggered via referrer from external domains

Detection Strategies

• Implement web application firewall (WAF) rules to alert on GET requests to the /jobs/cache/ endpoint
• Monitor server access logs for export endpoint access patterns that deviate from normal POST-based workflows
• Deploy intrusion detection signatures that identify attempts to access export functionality via non-POST methods
• Enable audit logging for all export generation events and correlate with HTTP method used

Monitoring Recommendations

• Review MISP access logs for anomalous export generation patterns, particularly those not using POST method
• Set up alerts for high-frequency access to export endpoints that could indicate exploitation attempts
• Monitor for unusual data exfiltration patterns following export generation events
• Implement real-time monitoring of the JobsController.php cache function invocations

How to Mitigate CVE-2024-25675

Immediate Actions Required

• Upgrade MISP to version 2.4.184 or later immediately
• Review recent access logs for potential exploitation of the export endpoints via GET requests
• Implement network-level controls to restrict access to MISP instances from untrusted networks
• Enable CSRF protection mechanisms on all MISP endpoints if not already configured

Patch Information

The MISP development team has released a fix in version 2.4.184. The patch adds explicit POST method validation to the cache function in JobsController.php and updates the view template in export.ctp to use proper POST-based form links. The specific commit addressing this vulnerability can be found in the MISP GitHub repository commit 0ac2468. Organizations should review the version comparison between v2.4.183 and v2.4.184 for a complete list of changes.

Workarounds

• If immediate patching is not possible, consider disabling the cached exports feature by setting MISP.disable_cached_exports to true in configuration
• Implement reverse proxy or WAF rules to block non-POST requests to /jobs/cache/ endpoints
• Restrict network access to MISP to trusted IP ranges only
• Enable additional authentication requirements for export functionality at the network perimeter

# Configuration example to disable cached exports temporarily
# In MISP configuration (app/Config/config.php)
# Set the following configuration option:
# 'MISP.disable_cached_exports' => true

# WAF rule example (ModSecurity format) to block GET requests to cache endpoint
SecRule REQUEST_URI "@contains /jobs/cache" \
    "id:1001,phase:1,deny,status:403,log,msg:'Blocked non-POST request to MISP cache endpoint',\
    chain"
SecRule REQUEST_METHOD "!@streq POST"