TheHive /api/status Unauthenticated Information Disclosure

--- Vulnerability Overview Vulnerability 1: GET /api/status Exposes Attachment Protection Password (No Authentication Required) Package: TheHive-Project/TheHive Affected Versions: Confirmed in commit d390a03 (as of 2025-05-25) and strangebee/thehive:5.4 (5.4.11-1) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (5.3 Medium) CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Summary in TheHive returns the runtime attachment protection password ( ) without requiring authentication. Any caller with network access to TheHive's port can retrieve the configured ZIP password used to protect malicious attachment downloads. This endpoint also discloses configured authentication providers, SSO settings, MFA capabilities, and in cluster deployments, member node addresses and roles. Details File: The action uses the ScalaGraph pattern, lacking , , or calls. All protected endpoints use these chained variants; their absence here means the request completely bypasses authentication. The password value is read from (default: "malware", in ). When operators configure a non-default password, this custom password is still returned via this unauthenticated endpoint. The route is registered in : No authentication middleware wraps this route: no session, API key, or Basic authentication header is required to access it. PoC Test environment: strangebee/thehive:5.4 (5.4.11-1), default configuration, no credentials. Control request: Unauthenticated requests to protected endpoints return 401: Requests with invalid credentials to still return 200 (the endpoint does not check): Impact 1. Attachment Password Leakage: TheHive is a security incident response platform used for handling malicious samples and sensitive evidence. Attachments are ZIP-compressed and protected by a configured password. Any unauthenticated caller can retrieve this password and use it to open attachments obtained via other means (e.g., network capture, storage access, misconfigured S3 buckets). If operators have not set a non-default password to prevent accidental access, the password is immediately compromised. 2. Authentication Surface Enumeration: The array lists all configured authentication providers ( , , , etc.), and the list indicates whether API key authentication, MFA, or SSO is enabled. This information can be used for credential stuffing or targeted attacks against specific providers. 3. Cluster Topology Leakage (Multi-node): In cluster TheHive deployments, contains member addresses, ports, statuses, and roles, with each node included in the client response. This reveals the internal network topology to unauthenticated callers. Remediation Recommended fix: Add to the action chain to require a valid session or API key for the endpoint. If a public status endpoint is needed for load balancer health checks, it should return only HTTP 200 without sensitive fields. The attachment password field should never be included in any client response. --- Vulnerability 2: Cross-Organization Attachment Leakage (Missing Object-Level Authorization) Package: TheHive-Project/TheHive Affected Versions: 4.1.24 and earlier 4.x versions ( has been a no-op since at least the introduction of this code path // TODO, unfixed in 4.1.24) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/H:H/N/A:N CWE: CWE-639 (Authorization Bypass Through User-Controlled Key) Summary TheHive's attachment download endpoints ( and ) do not perform any organization or case-scoped authorization checks. Any authenticated caller can download the binary content of any attachment in the platform—including case evidence, observables, and forensic files—belonging to completely unrelated organizations/tenants, simply by knowing or guessing the attachment's content-hash identifier, which is typically exposed to the file's legitimate owner in normal observable API responses. Details ( ) is defined as a literal no-op via an unannotated comment: Other core resource types (Case, Task, Observable, Alert, Log, Audit) implement as a graph traversal filter, restricting results to entities reachable from the caller's current organization. has never received this filter. and ( ) rely solely on this call as their only object-level access check: only verifies that the request carries a valid authenticated session ( ). It does not perform permission or ownership checks, unlike the codebase's own helper functions used for permission-gated operations. Since is a no-op, the combined effect is that any authenticated user, regardless of organization, can fetch any attachment. The route registration lacks a scope in the path ( ): There is no v1 equivalent ( has commented out), so v0 routes constitute the complete and only attack surface. Attachment IDs are SHA-based content hashes assigned during upload ( , ), not per-organization random identifiers. They are returned directly in normal, legitimate API responses (case observable creation and listing, case export, connector sync payloads) to organiz

Goal Reached Thanks to every supporter — we hit 100%!

TheHive /api/status Unauthenticated Information Disclosure

More from this source