MISP / MISP/misp-modules

Invalid response received from module reversedns - Using "Enrich Event"

Open
#707 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

Hey there,

Running latest version of the misp-modules and have updated all :)

Here is a sample MISP event to replicate
misp.event.1788.json

First I mark all the IP's:
image

Then click on the "Enrich Event" and choose the "reversedns"
image

This results in this error:

image

2024-12-17 19:25:37 Error: [RuntimeException] Invalid response received from module reversedns, response data do not contains results field.
Request URL: /events/enrichEvent/1788
Stack Trace:
#0 /var/www/MISP/app/Model/Event.php(6301): Event->enrichment()
#1 /var/www/MISP/app/Controller/EventsController.php(5985): Event->enrichmentRouter()
#2 [internal function]: EventsController->enrichEvent()
#3 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(499): ReflectionMethod->invokeArgs()
#4 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction()
#5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()
#6 /var/www/MISP/app/webroot/index.php(105): Dispatcher->dispatch()
#7 {main}

So the IP's it is hitting error on seems to be "8.8.1.1" that does not have a reverse DNS name to it if a normal nslookup returns

nslookup 8.8.1.1
** server can't find 1.1.8.8.in-addr.arpa: NXDOMAIN

The interesting part is that as far as I can see the code it looks to attempt to handle NXDOMAIN, but it must be the combination of attempting to enrich through "Enrich Event".

If I choose the "8.8.1.1" and click the "Add enrichment" it returns

image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with the attached event and the reversedns module, then trace the enrichment path through app/Model/Event.php and app/Controller/EventsController.php. Compare the Enrich Event behavior for 8.8.1.1 with the successful Add enrichment path; done means NXDOMAIN responses no longer produce an invalid-response error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.