The SSRF vulnerability in MISP cti-transmute affects versions up to 1.4.0 in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine only rejected IP literals that were private, loopback, link-local, or reserved, but did not resolve domain names to verify their IP addresses. An attacker could provide a hostname that resolves to an internal IP address, causing the server to send requests to internal network resources and read the responses. The vulnerability allows anonymous users to exploit this behavior. The fix implemented resolves hostnames using socket.getaddrinfo(), verifies that all resolved IP addresses are globally routable, and adds authentication requirements (@login_required) to the affected endpoints.

An unauthenticated attacker can exploit this SSRF vulnerability to make the vulnerable server send requests to internal network resources, potentially accessing sensitive internal services or data. The attacker can read the responses from these internal requests, which may lead to information disclosure or further internal network reconnaissance. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating significant risk if exploited.

A fix is available that resolves hostnames properly and restricts requests to globally routable IP addresses only. Additionally, the affected endpoints now require authentication to prevent anonymous exploitation. Users should upgrade to a version later than 1.4.0 where these fixes are applied. Patch status is not explicitly confirmed in the provided data, so verify the vendor advisory for the latest remediation guidance.