298 lines
18 KiB
JSON
298 lines
18 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-92003",
|
||
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "CIRCL",
|
||
"dateReserved": "2026-09-15T11:43:17.522Z",
|
||
"datePublished": "2026-09-15T11:43:19.403Z",
|
||
"dateUpdated": "2026-09-15T12:32:06.515Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"modules": [
|
||
"app/Controller/AppController.php"
|
||
],
|
||
"product": "MISP",
|
||
"programFiles": [
|
||
"app/Controller/AppController.php"
|
||
],
|
||
"repo": "https://github.com/MISP/MISP",
|
||
"vendor": "MISP",
|
||
"versions": [
|
||
{
|
||
"lessThan": "2.5.46",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "remediation developer",
|
||
"value": "iglocska"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "remediation developer",
|
||
"value": "Claude Opus 5 (1M context)"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.</p>\n<p>Two API authentication failure branches wrote directly to the <code>Log</code> model:</p> - API requests with <strong>no authentication key</strong>;<br><div> - requests supplying an API key with an <strong>incorrect length</strong></div><div><strong><br></strong></div><p>Unlike other authentication failures, these paths bypassed <code>_shouldLog()</code>, so every request could create another durable <code>auth_fail</code> entry.</p>Version affected: ≤2.5.45<br>"
|
||
}
|
||
],
|
||
"value": "Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n - API requests with no authentication key;\n - requests supplying an API key with an incorrect length\n\n\n\n\nUnlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.\n\nVersion affected: ≤2.5.45"
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-125",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-125 Flooding"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"attackVector": "NETWORK",
|
||
"baseScore": 6.9,
|
||
"baseSeverity": "MEDIUM",
|
||
"privilegesRequired": "NONE",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"subAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "NONE",
|
||
"subIntegrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
|
||
"version": "4.0",
|
||
"vulnAvailabilityImpact": "LOW",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-770",
|
||
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-400",
|
||
"description": "CWE-400 Uncontrolled Resource Consumption",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
|
||
"shortName": "CIRCL",
|
||
"dateUpdated": "2026-09-15T11:43:19.403Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"name": "Security patch",
|
||
"tags": [
|
||
"patch"
|
||
],
|
||
"url": "https://github.com/MISP/MISP/commit/2bf887433"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.</p>"
|
||
}
|
||
],
|
||
"value": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting."
|
||
}
|
||
],
|
||
"title": "MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion",
|
||
"x_gcve": [
|
||
{
|
||
"extensions": {
|
||
"bcp-05-x-01": {
|
||
"ai_annotations": [
|
||
{
|
||
"ai_level": "generated",
|
||
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
|
||
"gna_source": 1,
|
||
"models": [
|
||
{
|
||
"gna_source": 1,
|
||
"identifier": "qwen3.8:27b",
|
||
"name": "qwen3.8:27b",
|
||
"source": "ollama"
|
||
}
|
||
],
|
||
"review_status": "review",
|
||
"scope": "record",
|
||
"tags": [
|
||
"ai-computer-assisted:llm-generated",
|
||
"ai-computer-assisted:classification"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"bcp-05-x-02": {
|
||
"x_patch2vuln": {
|
||
"assumptions": [
|
||
"The tag_version_boundary (v2.5.46, 188 commits after fix) is used as an approximate upper bound for affected versions; the exact fixed release tag is not stated in the patch metadata.",
|
||
"The log entries are written to a relational database (MySQL/PostgreSQL) via MISP's Log model, based on the createLogEntry() call pattern; the specific backend is not confirmed in the patch.",
|
||
"The Redis instance used for throttling is assumed to be co-located with the MISP application; a Redis outage degrades to logging everything (fail-open), which is a design choice documented in the patch comments.",
|
||
"CVSS VA:H assumes that sustained unthrottled log writes can exhaust storage or I/O capacity sufficient to degrade or halt the MISP service; actual impact depends on deployment sizing and disk capacity."
|
||
],
|
||
"commit": "2bf8874336518d8c5ef6a42e51e78900ec242630",
|
||
"confidence": "medium",
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "remediation developer",
|
||
"value": "iglocska"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "remediation developer",
|
||
"value": "Claude Opus 5 (1M context)"
|
||
}
|
||
],
|
||
"cvssRationale": "The vulnerable paths are reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N). The attack complexity is low (AC:L): an attacker simply sends repeated HTTP requests to the MISP API without an API key or with a key of the wrong length. No attack target is required (AT:N). There is no impact on confidentiality (VC:N, SC:N) or integrity (VI:N, SI:N). The availability impact is high (VA:H) because unbounded log writes can exhaust database storage, degrade query performance, and ultimately make the MISP instance unavailable. No secondary availability impact (SA:N) is evident from the patch.",
|
||
"draft": false,
|
||
"fixSummary": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.",
|
||
"generatedAt": "2026-09-15T11:37:41.625192Z",
|
||
"generator": "patch2vuln.py",
|
||
"model": "qwen3.8:27b",
|
||
"modelComparison": {
|
||
"rankings": [
|
||
{
|
||
"agreementScore": 9,
|
||
"assumptionCount": 4,
|
||
"confidence": "medium",
|
||
"model": "qwen3.8:27b",
|
||
"score": 6
|
||
}
|
||
],
|
||
"selectedModel": "qwen3.8:27b",
|
||
"selectionMethod": "deterministic-consensus-v1",
|
||
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
|
||
},
|
||
"patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3",
|
||
"patchSummary": "In app/Controller/AppController.php: (1) The 'no authkey' branch in beforeFilter() now calls _shouldLog('noauthkey:' . $this->User->_remoteIp()) before writing the log entry. (2) The 'incorrect length' branch in __loginByAuthKey() now calls _shouldLog('badauthkeylength:' . $this->User->_remoteIp()) before writing the log entry. (3) _shouldLog() is refactored to first check a per-request memo array (Configure 'CurrentRequestAuthFailKeys') to suppress duplicate logging across the double beforeFilter() invocation, then evaluate the log_each_individual_auth_fail setting, then fall through to the Redis EXISTS/SETEX 3600-second throttle, and finally record the key in the memo. The Redis-unavailable fallback (log everything) is preserved.",
|
||
"patchTruncated": false,
|
||
"patches": [
|
||
{
|
||
"commit": "2bf8874336518d8c5ef6a42e51e78900ec242630",
|
||
"patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3",
|
||
"source": "https://github.com/MISP/MISP/commit/2bf887433.patch",
|
||
"sourceUrl": "https://github.com/MISP/MISP/commit/2bf887433.patch",
|
||
"subject": "fix: [logging] Throttle the two unguarded auth_fail writes"
|
||
}
|
||
],
|
||
"source": "https://github.com/MISP/MISP/commit/2bf887433.patch",
|
||
"subject": "fix: [logging] Throttle the two unguarded auth_fail writes",
|
||
"tagVersionBoundary": {
|
||
"commits_after_fix": 188,
|
||
"repository": "https://github.com/MISP/MISP",
|
||
"tag": "v2.5.46",
|
||
"version": "2.5.46",
|
||
"version_type": "semver"
|
||
},
|
||
"weaknessRationale": [
|
||
{
|
||
"cweId": "CWE-770",
|
||
"rationale": "Two authentication-failure log write paths lacked any rate-limiting or throttling mechanism, allowing an unauthenticated remote attacker to generate an unbounded number of database log entries and exhaust storage or I/O resources. The fix adds the missing hourly per-key throttle."
|
||
},
|
||
{
|
||
"cweId": "CWE-400",
|
||
"rationale": "The unthrottled log writes constitute uncontrolled consumption of database write capacity and disk storage, enabling a denial-of-service condition. CWE-770 is the more specific primary weakness; CWE-400 captures the broader resource-exhaustion impact."
|
||
}
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"recordType": "advisory",
|
||
"vulnId": "GCVE-1-2026-20158"
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-09-15T12:31:54.934768Z",
|
||
"id": "CVE-2026-92003",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-09-15T12:32:06.515Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |