Executive brief
MISP cti-transmute is a web-based tool for converting and fetching threat intelligence data. The application contained a server-side request forgery (SSRF) vulnerability in its MISP data fetch endpoints that allowed unauthenticated attackers to make the server issue requests to internal network resources by providing hostnames that resolve to private IP addresses, potentially exposing internal service responses.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in the /fetch_misp_event and /misp_search_events endpoints. The URL validation logic checked for private/loopback/reserved IP literals directly but failed to validate domain names by performing DNS resolution first. An attacker could supply a hostname that resolves to an internal IP address, causing the server to make requests into its internal network and return responses to the attacker. The endpoints were accessible to unauthenticated users. The fix resolves hostnames using socket.getaddrinfo(), validates that all resolved addresses are globally routable, and adds @login_required decorators to both endpoints.
Affected products
- MISP cti-transmute
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Fix applied in commit 4d29109