A server-side request forgery vulnerability in MISP cti-transmute allows unauthenticated attackers to interact with internal network resources.

This is a server-side request forgery vulnerability (CWE-918) within the evaluation report PDF-generation process. The vulnerability does not require authentication, allowing an attacker to force the server to make unauthorized requests.

Successful exploitation allows an attacker to bypass firewalls and interact with internal network services that are otherwise inaccessible from the internet. This can lead to the exposure of sensitive internal data, service enumeration, or potential interaction with vulnerable internal APIs. Given the CVSS score of 8.8, this represents a significant risk to the internal security posture of the host network.

Immediate Action: Update the cti-transmute tool to the latest version, ensuring that the fix provided in commit 20f35307bcb706c8dd8ca3884a88fb36b05b5244 is included.

Proactive Monitoring: Monitor egress traffic from the server running cti-transmute for suspicious or unexpected outbound requests to internal network segments.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious requests that attempt to exploit the PDF-generation endpoint.

Public Exploit Available: No (no confirmed weaponized exploit or Metasploit/ExploitDB entry identified).

Due to the unauthenticated nature and high CVSS score, this vulnerability should be treated with high urgency. Organizations using MISP cti-transmute should verify their current version and apply the upstream fix immediately. Until the patch is applied, ensure the application is restricted from reaching sensitive internal network resources.