MISP Can't delete any event after S3 configuration

Hello!

MISP running: v2.4.142 (269253aa78c1230d18c6cf5a4b14afb958ac5c84)

After configuring the S3 plugin I'm unable to delete events.

This is the log when $SUDO_WWW -- $CAKE Admin setSetting "MISP.attachments_dir" "s3://" is pointing to s3.

2021-05-06 17:14:22 Error: [InternalErrorException] Delete of event file directory failed. Please report to administrator.
Request URL: /events/delete/39080
Stack Trace:
#0 /var/www/MISP/app/Lib/cakephp/lib/Cake/Event/CakeEventManager.php(242): Event->beforeDelete()
#1 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(2694): CakeEventManager->dispatch()
#2 /var/www/MISP/app/Model/Event.php(1473): Model->delete()
#3 /var/www/MISP/app/Controller/EventsController.php(2556): Event->quickDelete()
#4 [internal function]: EventsController->delete()
#5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(499): ReflectionMethod->invokeArgs()
#6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction()
#7 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()
#8 /var/www/MISP/app/webroot/index.php(92): Dispatcher->dispatch()
#9 {main}

Undoing it, when $SUDO_WWW -- $CAKE Admin setSetting "MISP.attachments_dir" "$PATH_TO_MISP/app/files" is pointing to app/files everything works just fine.

May 07 '21 00:05 eschultze

I do realise that this is an old issue that might have been resolved already? We're able to delete events without any issues. If the issue still persists, make sure that you have the right permissions to S3 and also that the bucket is not subject to any object locking or write protection by other means.

Jul 03 '24 11:07 dygland

I am also seeing a very similar issue on MISP 2.5.6 Adding attachments to an event works great with the file being uploaded with the attachment id within a folder with the event id. Deleting the event throws these errors in /var/www/MISP/app/tmp/error.log.

Permissions are fine as I can use the AWS CLI on the MISP host to delete the attachment files without any issue.

2025-06-11 21:56:12 Error: Delete of event file directory failed.
[Aws\Exception\UnresolvedEndpointException] Input parameter `Prefix` is the wrong type. Must be a String.
Stack Trace:
#0 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/Ruleset/Ruleset.php(90): Aws\EndpointV2\Ruleset\RulesetParameter->validateInputParam()
#1 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/Ruleset/Ruleset.php(65): Aws\EndpointV2\Ruleset\Ruleset->validateInputParameters()
#2 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/EndpointProviderV2.php(53): Aws\EndpointV2\Ruleset\Ruleset->evaluate()
#3 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/EndpointV2Middleware.php(104): Aws\EndpointV2\EndpointProviderV2->resolveEndpoint()
#4 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/Auth/AuthSelectionMiddleware.php(104): Aws\EndpointV2\EndpointV2Middleware->__invoke()
#5 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/InputValidationMiddleware.php(73): Aws\Auth\AuthSelectionMiddleware->__invoke()
#6 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/Middleware.php(110): Aws\InputValidationMiddleware->__invoke()
#7 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(772): Aws\Middleware::Aws

{closure}()
#8 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(795): Aws\S3\S3Client::Aws\S3
{closure}
()
#9 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(729): Aws\S3\S3Client::Aws\S3

{closure}()
#10 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(748): Aws\S3\S3Client::Aws\S3
{closure}
()
#11 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/Middleware.php(78): Aws\S3\S3Client::Aws\S3

{closure}()
#12 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/SSECMiddleware.php(59): Aws\Middleware::Aws
{closure}
()
#13 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/IdempotencyTokenMiddleware.php(77): Aws\S3\SSECMiddleware->__invoke()
#14 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/AwsClientTrait.php(64): Aws\IdempotencyTokenMiddleware->__invoke()
#15 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/AwsClientTrait.php(58): Aws\AwsClient->executeAsync()
#16 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/AwsClientTrait.php(86): Aws\AwsClient->execute()
#17 /var/www/MISP/app/Lib/Tools/AWSS3Client.php(132): Aws\AwsClient->__call()
#18 /var/www/MISP/app/Lib/Tools/AttachmentTool.php(282): AWSS3Client->deleteDirectory()
#19 /var/www/MISP/app/Model/Event.php(410): AttachmentTool->deleteAll()
#20 /var/www/MISP/app/Lib/Tools/BetterCakeEventManager.php(21): Event->beforeDelete()
#21 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(2695): BetterCakeEventManager->dispatch()
#22 /var/www/MISP/app/Model/Event.php(1417): Model->delete()
#23 /var/www/MISP/app/Controller/EventsController.php(2975): Event->quickDelete()
#24 [internal function]: EventsController->delete()
#25 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(500): ReflectionMethod->invokeArgs()
#26 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction()
#27 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()
#28 /var/www/MISP/app/webroot/index.php(107): Dispatcher->dispatch()
#29 {main}
2025-06-11 21:56:12 Error: [InternalErrorException] Delete of event file directory failed. Please report to administrator.
Request URL: /events/delete
Stack Trace:
#0 /var/www/MISP/app/Lib/Tools/BetterCakeEventManager.php(21): Event->beforeDelete()
#1 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(2695): BetterCakeEventManager->dispatch()
#2 /var/www/MISP/app/Model/Event.php(1417): Model->delete()
#3 /var/www/MISP/app/Controller/EventsController.php(2975): Event->quickDelete()
#4 [internal function]: EventsController->delete()
#5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(500): ReflectionMethod->invokeArgs()
#6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction()
#7 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()
#8 /var/www/MISP/app/webroot/index.php(107): Dispatcher->dispatch()
#9 {main}

Jun 11 '25 22:06 mdhirt

I am also seeing a very similar issue on MISP 2.5.6 Adding attachments to an event works great with the file being uploaded with the attachment id within a folder with the event id. Deleting the event throws these errors in /var/www/MISP/app/tmp/error.log.

Permissions are fine as I can use the AWS CLI on the MISP host to delete the attachment files without any issue.

This was resolved with https://github.com/MISP/MISP/pull/10244 which was released in 2.5.8, I suggest that you update (also since a bunch of security issues has been resolved since then).

Jun 12 '25 06:06 dygland

Just updated to MISP 2.5.9 and I am still getting this same Prefix issue posted previously. The attachment gets deleted from S3 but the event fails to delete. Error is 2025-06-25 07:06:39 Error: Delete of event file directory failed. [Aws\Exception\UnresolvedEndpointException] Input parameter Prefixis the wrong type. Must be a String. Stack Trace: #0 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/Ruleset/Ruleset.php(90): Aws\EndpointV2\Ruleset\RulesetParameter->validateInputParam() #1 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/Ruleset/Ruleset.php(65): Aws\EndpointV2\Ruleset\Ruleset->validateInputParameters() #2 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/EndpointProviderV2.php(53): Aws\EndpointV2\Ruleset\Ruleset->evaluate() #3 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/EndpointV2/EndpointV2Middleware.php(104): Aws\EndpointV2\EndpointProviderV2->resolveEndpoint() #4 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/Auth/AuthSelectionMiddleware.php(104): Aws\EndpointV2\EndpointV2Middleware->__invoke() #5 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/InputValidationMiddleware.php(72): Aws\Auth\AuthSelectionMiddleware->__invoke() #6 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/Middleware.php(110): Aws\InputValidationMiddleware->__invoke() #7 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(774): Aws\Middleware::Aws\{closure}() #8 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(797): Aws\S3\S3Client::Aws\S3\{closure}() #9 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(731): Aws\S3\S3Client::Aws\S3\{closure}() #10 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/S3Client.php(750): Aws\S3\S3Client::Aws\S3\{closure}() #11 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/Middleware.php(78): Aws\S3\S3Client::Aws\S3\{closure}() #12 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/S3/SSECMiddleware.php(59): Aws\Middleware::Aws\{closure}() #13 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/IdempotencyTokenMiddleware.php(79): Aws\S3\SSECMiddleware->__invoke() #14 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/AwsClientTrait.php(64): Aws\IdempotencyTokenMiddleware->__invoke() #15 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/AwsClientTrait.php(58): Aws\AwsClient->executeAsync() #16 /var/www/MISP/app/Vendor/aws/aws-sdk-php/src/AwsClientTrait.php(86): Aws\AwsClient->execute() #17 /var/www/MISP/app/Lib/Tools/AWSS3Client.php(132): Aws\AwsClient->__call() #18 /var/www/MISP/app/Lib/Tools/AttachmentTool.php(282): AWSS3Client->deleteDirectory() #19 /var/www/MISP/app/Model/Event.php(411): AttachmentTool->deleteAll() #20 /var/www/MISP/app/Lib/Tools/BetterCakeEventManager.php(21): Event->beforeDelete() #21 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(2695): BetterCakeEventManager->dispatch() #22 /var/www/MISP/app/Model/Event.php(1420): Model->delete() #23 /var/www/MISP/app/Controller/EventsController.php(2980): Event->quickDelete() #24 [internal function]: EventsController->delete() #25 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(500): ReflectionMethod->invokeArgs() #26 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction() #27 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke() #28 /var/www/MISP/app/webroot/index.php(107): Dispatcher->dispatch() #29 {main} 2025-06-25 07:06:39 Error: [InternalErrorException] Delete of event file directory failed. Please report to administrator. Request URL: /events/delete Stack Trace: #0 /var/www/MISP/app/Lib/Tools/BetterCakeEventManager.php(21): Event->beforeDelete() #1 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(2695): BetterCakeEventManager->dispatch() #2 /var/www/MISP/app/Model/Event.php(1420): Model->delete() #3 /var/www/MISP/app/Controller/EventsController.php(2980): Event->quickDelete() #4 [internal function]: EventsController->delete() #5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(500): ReflectionMethod->invokeArgs() #6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction() #7 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke() #8 /var/www/MISP/app/webroot/index.php(107): Dispatcher->dispatch() #9 {main}

Jun 25 '25 07:06 mdhirt

Please ignore my message above. I just looked at the AttachmentTool.php and the changes linked in this ticket are not in the image. I will investigate our build pipeline to see why the MISP 2.5.9 source has not made it into my image.

Jun 30 '25 03:06 mdhirt

OK I found the issue. Looks like this fix was merged into MISP 2.5.10, not 2.5.8. For anyone else having this same issue, upgrade to 2.5.10 or later to fix it.

Jun 30 '25 04:06 mdhirt