Our in-depth security assessment revealed five vulnerabilities – three of medium severity and two of low severity.
Announcement
Security upgrade: release of TheHive versions 5.2.9 and 5.1.10
Jérôme Léonard
COO
Key findings from the penetration test
Medium Severity Vulnerabilities
- SB-SEC-ADV-2023-001 (Reporting – Stored Cross-Site Scripting): This vulnerability can lead to account impersonation, including those with administrator privileges.
- SB-SEC-ADV-2023-002 (Attachment – Stored Cross-Site Scripting): Exploitation of this flaw can coerce a victim account to elevate another user’s privileges unintentionally.
- SB-SEC-ADV-2023-003 (Branding Logo – Reflected Cross-Site Scripting): Similar to SB-SEC-ADV-2023-001, this vulnerability can also result in account impersonation.
Note: Exploitation of these vulnerabilities requires specific conditions, such as dual-role (Analyst and Administrator) accounts, which limits the potential for widespread misuse.
Low Severity Vulnerabilities
- SB-SEC-ADV-2023-004 (MFA – Lack of Lockout Policy): Absence of account lockout in response to repeated incorrect multi-factor authentication attempts.
- SB-SEC-ADV-2023-005 (Username Enumeration): Potential for attackers to identify whether accounts are registered or not on the platform.
For detailed insights, please refer to the individual advisories on our security repository.
Required updates
To address these vulnerabilities, we have implemented patches in TheHive versions 5.2.9 and 5.1.10. We strongly urge all users to upgrade to version 5.2.9, or at least to version 5.1.10 for those still using TheHive v.5.1.
Reporting security issues
We encourage responsible collaboration in identifying and reporting potential security issues. Please visit our Responsible Vulnerability Disclosure Policy page for guidelines on secure reporting.
Credits
We are thankful to Randorisec for its exemplary penetration testing services. RandoriSec is an offensive security company with a team of experienced consultants who help the company’s clients contain technology-related risks. Their expertise has been instrumental in enhancing the security and reliability of TheHive.
Blog categories
About author
Jérôme Léonard
COO
