MISP File Upload Validation Logic Vulnerability in Events Controller

A vulnerability exists in MISP versions prior to 2.5.24 within the EventsController.php file. The issue stems from an incorrect logic in verifying the validity of uploaded files, particularly concerning the temporary file name. This flaw could potentially be exploited to bypass file upload restrictions or to manipulate file upload processes.

Impact

Exploitation of this vulnerability could lead to local file inclusion, allowing an attacker to include files from the local file system into the application. This could be used to read sensitive files or, in some cases, execute code if the included file is a script.

Reproduction

To reproduce this vulnerability, upload a file through a feature that uses the 'importModule' function in the EventsController. The current validation logic can be bypassed, potentially leading to local file inclusion.

Remediation

Users can update to MISP version 2.5.24 or later, where this vulnerability has been fixed.