A high-severity Server-Side Request Forgery (SSRF) vulnerability in cti-transmute allows unauthenticated attackers to potentially access internal resources and sensitive data.

This SSRF vulnerability (CWE-918) exists within the /fetch_misp_event and /misp_search_events endpoints, allowing an unauthenticated attacker to force the application to make unauthorized requests to internal or external systems.

An attacker can exploit this vulnerability to perform reconnaissance on internal networks, bypass firewall protections, or interact with services that are not exposed to the public internet. Given the CVSS score of 8.7, this issue poses a significant risk of internal network compromise and unauthorized information disclosure.

Immediate Action: Review the official MISP repository for security updates, as a patch is required to restrict the allowed targets of the affected endpoints.

Proactive Monitoring: Monitor network logs for unusual outbound requests originating from the server hosting cti-transmute, specifically targeting internal IP ranges or sensitive metadata services.

Compensating Controls: Implement strict network egress filtering on the host running cti-transmute to prevent it from reaching internal network segments or unauthorized external endpoints.

Public Exploit Available: Unknown.

Due to the high severity and the unauthenticated nature of this SSRF vulnerability, organizations should prioritize restricting network access to the affected service until a vendor-supplied patch is applied. Monitor the MISP project documentation for release updates to address this flaw.