CTI-Transmute 1.5 fixes 16 flaws

MISP's CTI-Transmute conversion service patched 16 vulnerabilities in v1.5, including four unauthenticated high-severity bugs enabling SSRF, DoS, CSRF and local file disclosure.

CIRCL's CTI-Transmute project, an open-source MISP/STIX conversion and catalogue service, released version 1.5 following an external security review by Jeroen Pinoy plus an internal audit. The release remediates 16 distinct vulnerabilities, each tracked with its own GCVE/CVE identifier and regression test. Four of the findings carry High severity (CVSS 8.7-8.8) and are all exploitable without authentication or via forged requests: an HTML-injection flaw in the PDF export that let attackers read local files and probe internal services via file:// and internal URLs reaching the PDF renderer; a CSRF issue where account deletion was triggered via a GET request; an unauthenticated SSRF in the remote-MISP fetch routes that only checked IP literals, allowing hostname-based bypass into internal networks; and an unbounded parameter on the activity timeline enabling trivial denial-of-service. The remaining twelve Medium and one Low finding cover stored XSS, missing authorization checks exposing private data, and additional state-changing GET routes.

Beyond individual patches, the release hardens the application architecture: a nonce-based CSP, neutralized Vue template expression execution, hardened session cookies, a sandboxed PDF renderer that no longer touches the filesystem or network, authentication requirements on remote-fetch routes, and conversion of GET-based mutating routes to POST/DELETE with CSRF tokens. The update also ships a first-class public API with X-API-KEY authentication, a schema-driven parameter system, a reworked graph view (Pivotick 1.5, also hardened), and expanded test coverage (0 to 516 tests) with CI enforcement.

This is a vendor security-fix advisory rather than a report of active exploitation; there is no evidence any of the flaws were exploited in the wild. However, given the unauthenticated, low-complexity nature of the four High-severity issues (SSRF, CSRF, file disclosure, DoS) and the tool's use within the threat-intel community, operators running earlier versions should upgrade promptly and follow the documented migration/breaking-change guidance (route method changes, session cookie defaults, CSP updates).

title: Unauthenticated SSRF via Hostname Bypass in MISP Remote Fetch
description: Detects unauthenticated HTTP requests to MISP remote-fetch endpoints
  (e.g., /remote-misp/fetch) supplying hostname parameters that resolve to or target
  internal/RFC1918 IP ranges, bypassing IP-literal-only validation.
tags:
- attack.t1190
logsource:
  category: proxy
  product: unknown
detection:
  selection:
    RequestMethod: GET
    Url|contains:
    - /remote-misp/fetch
    - /remote-misp
    QueryString|contains:
    - url=
    - hostname=
    - host=
  selection_internal_target:
    QueryString|re:
    - (localhost|127\.0\.0\.1|192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)
  selection_no_auth:
    http_authorization: null
  condition: selection and selection_internal_target and selection_no_auth
falsepositives:
- Legitimate internal automation fetching from local MISP instances using hostnames
- Authorized API calls with explicit internal URL parameters in test environments
level: high
id: c6ac6379-fc08-58fa-8252-36f99e6bfefe
status: experimental
author: Vorant

title: Unauthenticated Account Deletion via GET Request (CSRF)
description: Detects HTTP GET requests to user/account deletion routes (typical MISP/CTI-Transmute
  pattern) lacking POST method enforcement or CSRF token validation, enabling state-changing
  actions via forged cross-site requests.
tags:
- attack.t1499
- attack.impact
logsource:
  category: proxy
  product: unknown
detection:
  selection:
    RequestMethod: GET
    Url|contains:
    - /user/delete
    - /account/delete
    - /user/remove
    - /account/remove
  selection_no_token:
    QueryString|contains:
    - csrf=
    - _token=
    QueryString: null
  condition: selection and selection_no_token
falsepositives:
- POST-converted endpoints where legacy GET support remains for backward compatibility
- Proxy rules stripping CSRF tokens from query strings before logging
level: high
id: 211d2905-62fe-5fb4-8b09-bce23287b3a3
status: experimental
author: Vorant

title: Unbounded Activity Timeline Parameter Denial of Service
description: Detects HTTP requests to activity/timeline query endpoints supplying
  unbounded or extremely large limit, offset, or page parameters, exploiting missing
  validation to trigger CPU/memory exhaustion and denial of service.
tags:
- attack.t1499
- attack.impact
logsource:
  category: proxy
  product: unknown
detection:
  selection:
    Url|contains:
    - /activity
    - /timeline
    QueryString|contains:
    - limit=
    - offset=
    - page=
  selection_large_param:
    QueryString|re: (limit|offset|page)=(\d{6,}|[1-9]\d{8,})
  condition: selection and selection_large_param
falsepositives:
- Legitimate bulk exports or admin reports requesting large result sets with proper
  pagination
- Monitoring tools fetching extended activity logs with intentionally high limits
level: medium
id: 24176db1-d4ad-57ba-8f07-aac60eb0b2f9
status: experimental
author: Vorant

Source reporting: https://www.misp-project.org/2026/08/11/cti-transmute-v1.5-released.html