TheHive /api/status Unauthenticated Information Disclosure & CVE Analysis

Vulnerability Overview Vulnerability 1: GET /api/status exposes unauthenticated attachment protection password Package: TheHive-Project/TheHive Affected Versions: Confirmed in commit d390a03 (HEAD as of 2026-05-25) and strangebee/thehive:5.4 (5.4.11-1) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (5.3 Medium) CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Summary: TheHive's endpoint returns the runtime attachment protection password ( ) in plaintext without authentication. Anyone with network access can retrieve the configured ZIP password, which is used to protect malicious attachment downloads. This endpoint also discloses configured authentication providers, SSO settings, MFA capabilities, and member node addresses and roles in cluster deployments. Details: File: The operation uses the endpoint pattern and does not include , , or calls. All protected endpoints in the codebase use one of these chained variants; the absence here means the request completely bypasses authentication. The password value is read from (defaulting to "malware" in ). When operators configure a non-default password (as recommended for environments handling sensitive attachments), this custom password is returned to unauthenticated users. The route is registered in . No authentication middleware is applied; the route is accessible in responses from any client in the Akka cluster without requiring a session, API key, or basic authentication. PoC: Impact: 1. Attachment Password Leakage: TheHive is a security incident response platform used to handle malicious samples and sensitive data. Attachments are compressed and protected with a configured password. Any unauthenticated user can retrieve this password and use it to open attachment ZIPs obtained through other means (e.g., network capture, storage access, misconfigured S3 buckets). If operators have set non-default passwords to restrict accidental access to archives, this protection is immediately undermined. 2. Authentication Surface Enumeration: The array lists all configured authentication providers ( , , , etc.), and the list indicates whether API key authentication, MFA, or SSO is enabled. This information can be used for credential stuffing or targeted attacks against specific providers. 3. Cluster Topology Leakage (Multi-node): In cluster TheHive deployments, includes member addresses, ports, status, and roles. This reveals the internal network topology to unauthenticated callers. Recommended Fix: Add to the operation chain so that the endpoint requires a valid session or API key. If the public status endpoint is reduced for load balancer health checks, it should only return HTTP 200 with no sensitive fields. The attachment password field must never be included in any client response. --- Vulnerability 2: Cross-organization attachment leakage via unauthorized data endpoints (missing object-level authorization) Package: TheHive-Project/TheHive Affected Versions: 4.1.24 and earlier 4.x versions ( is an unimplemented // TODO, unfixed since at least version 4.1.24) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CWE: CWE-639 (Authorization Bypass Through User-Controlled Key) Summary: TheHive 4's attachment download endpoints ( and ) do not perform organization or case-scoped authorization checks. Any authenticated user can download the binary content of any attachment in the platform—including case evidence, observables, and forensic files belonging to completely unrelated organizations/tenants—simply by knowing or guessing the content hash identifier of the attachment, which is typically exposed to the file's legitimate owner in normal case observable API responses. Details: ( ) is defined as an unhandled comment via traversal: Other core resource types in TheHive (Case, Task, Observable, Alert, Log, Audit) implement as a graph traversal filter, restricting results to entities reachable from the caller's current organization. never received this filter. and ( ) rely solely on this call as their only object-level access check: The endpoint (...) only verifies that the request carries a valid authenticated session ( ). It does not perform permission or ownership checks, unlike the codebase's helper used for permission-gated operations. Since is ineffective, the combined effect is that any authenticated user, regardless of organization, can retrieve any attachment. There are no case/organization-scoped paths in the route registration ( ): There is no v1 equivalent ( has commented out), so these v0 routes constitute the complete and only attack surface for this resource class. Attachment IDs are content hashes based on SHA (allocated at upload time) ( , ), not cross-organization random identifiers. They are returned directly in normal, legitimate API responses (case/observable creation and listing, case exports, connector synchronization payloads) to the organization's owners, making them regularly obtainable values rather than theo

Goal Reached Thanks to every supporter — we hit 100%!

TheHive /api/status Unauthenticated Information Disclosure & CVE Analysis

More from this source