Hash Verification

[securitiz]

Description

{When creating a File observable, OpenCTI no longer verifies that the MD5 value entered is a legitimate MD5 hash. The same goes for SHA1, SHA256}

Environment

1. OS (where OpenCTI server runs): { Demo instance }
2. OpenCTI version: { OpenCTI 4.1.1 }
3. OpenCTI client: { frontend}
4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Create new File object
2. Enter random digits as MD5
3. Click "Create"

Expected Output

Error - this is not a valid hash

Actual Output

Successfully created File object

Additional information

{

}

[richard-julien]

Hi @securitiz,

And lib/rules in mind to check that? Thanks

[securitiz]

I'm not intimately familiar with the specs for each hash type, but you could initially check the value length, where:

• MD5 is 32 characters
• SHA1 is 40 characters
• SHA256 is 64 characters

Then you could ensure that all the characters are hexadecimal, (0-9, A-F, a-f).
This could be all verified with regex, and would be a sufficient start

[CyberDaedalus00]

If you want to be aligned with STIX 2.1 hash values, here are the regex patterns for hash algorithms in the spec:

• MD5 pattern: "^[a-fA-F0-9]{32}$"
• SHA-1 pattern: "^[a-fA-F0-9]{40}$"
• SHA-256 pattern: "^[a-fA-F0-9]{64}$"
• SHA-512 pattern: "^[a-fA-F0-9]{128}$"
• SHA3-256 pattern: "^[a-fA-F0-9]{64}$"
• SHA3-512 pattern: "^[a-fA-F0-9]{128}$"
• SSDEEP pattern: "^[a-zA-Z0-9/+:.]{1,128}$
• TLSH pattern: "^[a-zA-Z0-9]{70}$"

[richard-julien]

Thanks for your insights @securitiz and @CyberDaedalus00 .