I've read on a few sites that it's possible to conduct MITM attacks over WPA2-secured connections. So for example I could replace the content of a site a user tries to access over HTTP. Is this true? If so, how? My understanding is that during the WPA2 handshake the router and the user exchange a secret and use it to encrypt all their communication. Is there simply a bug in the protocol or implementation?
WAP2 only secures the wifi against outsiders. Once you are in the inside, e.g. using the service, your transmission medium is considered trusted, and it is up to the other layers to use other means of security and/or encryption. Or put otherwise, the encryption done at WPA2 only is effective for who is kept outside the network.
Regular spoofing attacks techniques do work over wifi too albeit some professional equipments have mitigations measures.
Wifi gives you a emulation of a cable network connection once you are authenticated. ARP spoofing is done exploiting the way ethernet/layer 2 works. It does not matter which protocol authentication you are using, what it matters is that you are in an emulated ethernet connection for ARP spoofing to work. In an enterprise setting the complication is that broadcasts/ARP spoofing mitigation measures can exist as the equipment has more functionalities, but that got nothing to do with the authentication protocol.
Please also do keep in mind that while wifi is a shared medium, supplementary configurations can be done, like doing 802.1X and having VLANs inside wifi, and so effectively you will only be able to listen/spoof in the VLAN your login is authorised to access.
Far more serious than spoofing, is however if the wifi providers are compromised or bad actors. It is a child´s play to divert your requests via a untrustworthy DNS, and also routinely in wifi/captive web portals DNS requests for the outside are captured and divert to the internal DNSes.
Please see my other post in this thread for related considerations about hijacking browser connections.
To put it simply, the above considerations are the reason why when you are in public wifis, it is advisable to use VPN technologies to protect yourself.
Sadly you have asked the question too early (Jan 2016) and the bug was actually found much later (2017):
WPA2 in its original design, was intended to defend against MITM attack (using the 4 way handshake).
So without this vulnerability, it is not possible to play MITM attack on it.
But because of this KRACK vulnerability (which resulted in the key resetting to zero, or so called "Key Reinstallation Attack - KRACK") iformation can be transfer as decrypted. The WPA2 password is still not leaked and kept secret, but is not used at all, as the zero key are used.
So if you communicate via HTTP, it can be MITM attack. Intruder does not know your WPA2 password and yet can MITM your HTTP traffic.
But if you communicate via HTTPS, MITM is not possible, as your client-end browswer will only recognize known public webserver, so your man-in-the-middle server will not authenticate successfully.