Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in the MISP Modules website component allows unauthenticated attackers to manage external tools, including their configurations and API keys, when an administrator password is set. This occurs because certain management endpoints for external tools do not enforce the administrator authentication policy. While installations without an administrator password permit open management by design, this inconsistency creates an unintended access control bypass for installations that do use a password.
- Unprotected website tool management.
- Attackers could alter tool configurations.
- Confirm if password protection is in use.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker with network access could manipulate external tools within the MISP Modules website if an administrator password is configured. This allows the attacker to add, delete, or reconfigure these tools, potentially including sensitive information like API keys and ingestion URLs. This manipulation is possible because the management endpoints for these tools do not properly check if the user is logged in.
- Network access required.
- External tools management endpoints.
- Compromise tool configurations.
Live Threat
Current exploitation, exposure, and threat context
When the `ADMIN_PASSWORD` is configured, unauthenticated users could manipulate external tool configurations for the MISP Modules website. This could allow an attacker to add, delete, or modify tools, including sensitive API keys and ingestion URLs, bypassing access controls when the administrator password is set.
- External tool configurations and API keys.
- Anonymous network requests to management endpoints.
- Unauthorized modification of integrated tools.
Operational Fix
Recommended remediation, mitigation, and detection steps
The MISP Modules website's external tool management functionality is likely managed by the application or platform team responsible for the MISP deployment. Given the vulnerability's reliance on the `ADMIN_PASSWORD` configuration, the first practical step is to confirm if this password is set. If it is, then the application owner must be identified to assess exposure and plan remediation, which may involve coordination with the vendor or applying a fix. If the password is not set, the system is operating as designed, and no immediate action is required for this specific vulnerability.
- Application or platform team ownership.
- Verify if ADMIN_PASSWORD is configured.
- Assess exposure and plan remediation if applicable.
