MISP vulnerabilities

On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of mandatory two-factor authentication applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing non-browser requests (AJAX/XHR, REST API, .json URLs, restSearch, automation). Because these requests cannot follow the redirect to the TOTP enrolment page, the guard was skipped, and the user retained full access without completing the second-factor setup. Fixes (commits 8deb0619e and 6b527ba6e) broadened the guard to cover all non-browser requests, except API key authentication. Affected version: <2.5.48.

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted. Security impact: stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure. Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing. Preconditions: an authenticated user with write access to at least one MISP event; the user modifies the event's distribution or sharing_group_id field. Affected versions: <2.5.48

MISP before version 2.5.48 has an improper input validation vulnerability in the decaying model import functionality. A user with perm_decaying permissions can overwrite existing models of other organizations, change their ownership, or create a default model, affecting scoring behavior.

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the linked server supplies a crafted tag ID in an event, and an authenticated user views the event preview and interacts with the affected tag element. Impact: arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user. Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: the victim must be an authenticated MISP user with access to the TAXII object viewer, and the victim must open or view the crafted TAXII object. Impact: execution of arbitrary JavaScript in the victim's browser within the MISP application context, potential theft of session tokens, API keys, or other sensitive data, and potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.

MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding. A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks. Preconditions: the victim must be an authenticated user of the host MISP instance, a linked server must be configured on the host instance, and the victim must navigate to the ID Translator page for a given event. Affected versions: <2.5.48.

MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the attacker has sufficient access on the linked server to create or modify an event with a crafted identifier, and a victim user on the local instance views the remote event preview index page. Impact: execution of arbitrary JavaScript in the context of the MISP web application, potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Affected versions: <2.5.48.

MISP before version 2.5.48 contains an incomplete authorization check in the discussion posting functionality. An authenticated user outside the sharing group or without visibility on the associated event can read the thread title and quoted post content, and submit new posts into the thread, to which they are not authorized.

MISP contains a reflected XSS vulnerability in the analyst data notes panel. The seed path parameter supplied via URL is passed directly into inline JavaScript without sanitization. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's browser. Affects versions prior to the fix (commit 58925dbf0, post v2.5.48).

MISP contains a reflected XSS vulnerability in legacy taxonomy tag confirmation forms (add and disable tag). The forms echoed user-supplied tag names without escaping. An attacker can trick an administrator into visiting a crafted URL with a malicious tag, allowing arbitrary JavaScript execution in the admin's session. Affects versions <2.5.48.

MISP contains an authorization bypass in the event flattening feature. When requesting an event with the flatten option, object-level access control is not re-applied to attributes, allowing unauthorized access. The initial fix introduced an issue with deleted attributes, which was resolved in the final version.

MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. Preconditions: the target user has HOTP (paper token) second-factor authentication enabled; the attacker possesses a valid session in which the password step has already been completed (the OTP step is pending); the attacker has access to at least one HOTP token value (e.g., a paper token list). Security impact: bypass of the second authentication factor, allowing unauthorized access to a user's MISP account; corruption of the HOTP counter state, potentially invalidating subsequent legitimate tokens or enabling further replays. Affected versions: <2.5.48.

MISP contains a stored XSS vulnerability in the galaxy icon handling path. The icon field is persisted without server-side validation and later concatenated into HTML by correlation graph rendering scripts. A user with perm_galaxy_editor can store arbitrary HTML/JavaScript that executes in another user's browser when viewing the correlation graph.

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink when the value passes FILTER_VALIDATE_URL, which accepts javascript: URIs. A user with galaxy editor privileges can store a javascript: URL, and when another user clicks it, the script executes in their browser.

MISP contains a stored cross-site scripting (XSS) vulnerability in the event graph preview feature. The event graph preview image field is accepted and stored without server-side validation, allowing a crafted value to break out of the attribute context and inject arbitrary script.

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload. A user with tag editor permission could craft a request that includes additional model data (such as User or Organisation records), enabling modification or creation of privileged accounts and escalation to site administrator.

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id. An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance, leading to unauthorized read access to events of other organizations, and if the delegation is accepted, transfer of event ownership.

MISP registers PHP's phar stream wrapper in both its web and console entry points. This causes filesystem operations on caller-influenced paths to trigger implicit unserialize() (a deserialization sink), and a relocated application root can reach executable code inside an uploaded phar file, enabling code execution as the web user.

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. The malformed key does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction — potentially resulting in either an authorization bypass or denial of access for legitimate users.

In MISP's UsersController login(), the pre-auth query for TOTP verification did not include the User.disabled column, so the disabled flag was not checked in that branch. Although later identify() validation still rejects disabled accounts, a TOTP-enabled user can proceed to the verification step.

In MISP, the __uploadLogo method in OrganisationsController processes a caller-supplied tmp_name with filesystem probes before verifying it is a real upload. An authenticated site-admin can supply an arbitrary server file path, allowing to check for file existence and determine image types.

In MISP, the __statisticsOrgs method uses the organization name directly as a file path component when checking for logo existence. Although the target directory does not exist, the pattern is a path traversal weakness that could allow probing arbitrary files if the directory existed.

The findOrgImage method in MISP constructs a file path from an organization identifier without validation, allowing path traversal. An authenticated user with ability to create or import events can set an organization name with traversal sequences, enabling arbitrary file existence probing and limited file read for .png or .svg extensions.

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.

In MISP, the EventReport::uploadPicture method processes a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format, allowing enumeration of file existence and type.

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name is interpolated directly into a JavaScript string literal without proper output encoding, allowing injection of arbitrary JavaScript. The injected script executes in the context of any authenticated user who loads the page, potentially enabling session hijacking, data exfiltration, or privileged actions.

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. Due to a logic error in the readFile guard condition in the Xml::build() library, a request containing a bare HTTPS URL can be fetched by the server as a resource. An unauthenticated attacker can send a crafted POST request to the cspReport endpoint to cause the server to issue an outbound HTTPS request to an arbitrary target reachable from the server, enabling scanning of internal services or attacks on internal endpoints.

In MISP, the queryEnrichment method in EventsController.php accepts a module name and iterates over the list of enabled modules. If the module is not found, the code continues with default parameters instead of rejecting the request, allowing an authenticated user to trigger enrichment via a module that was not enabled, bypassing availability controls.

In MISP, the add() method in CollectionsController enforces sharing-group authorization only for POST requests, but CRUDComponent::add() persists data on both POST and PUT. An authenticated user can send a PUT request to collections/add to create a collection with distribution=4 (shared with a specific group) without proper authorization, bypassing the access control.

MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe that capture sensitive data including admin, database, GPG, and supervisor passwords. These files are created with the system default umask, resulting in world-readable permissions (typically 0644). Additionally, the log file is not removed before creation, allowing a pre-existing symlink to redirect writes to an arbitrary location. Affected versions are <2.5.47.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without hex-encoding flags, allowing an attacker to inject a single-quote character and execute arbitrary JavaScript. The vulnerability affects the Default and UiBeta themes; the Overmind theme is not affected by this specific sink.

MISP contains a reflected XSS vulnerability in the attribute histogram view. The $selectedTypes variable, derived from the URL path segment, is interpolated directly into a JavaScript array literal inside an onClick HTML attribute without encoding. An attacker who can cause an authenticated user to visit a crafted URL can execute arbitrary JavaScript in the victim's browser within the MISP origin. Affected version: <2.5.47.

MISP contains a reflected XSS vulnerability in the AnalystDataController::viewForObject action. The method accepts a parent object type parameter from the URL without validation and passes it to the Overmind-themed AnalystData thread view element, where it is interpolated into two translated strings and rendered without output encoding. An authenticated attacker can induce a victim to visit a crafted URL, allowing arbitrary JavaScript execution in the victim's browser within the MISP context. Affected version: <2.5.47.

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action under unlockedActions disables both CSRF token check and field hash validation. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allows an attacker to craft a cross-site form post that, when submitted by an authenticated administrator, would invoke the action on the MISP instance. The attacker can select any workflow module, including action modules that write blocklist and warninglist entries, and supply arbitrary input. The vulnerability was found during internal review. The fix is included in MISP v2.5.47.

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user's browser without that user knowingly approving the change. The affected function did not properly enforce MISP's usual protection against forged requests, so an attacker could create a malicious webpage that silently sends a request to MISP. Version affected: <2.5.47.

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML, so a user with modify permissions could upload a file containing a local file path or a web address. Version affected: <2.5.47.

In MISP, when a regular user adds a reference between objects or attributes, the system checks whether the user can access the overall event but does not always check whether the individual pieces of data are also allowed for that user. A user who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.

In MISP, when a user creates or edits a report inside an event, the system can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. A user with editing rights on one event could move a report from another event into their own event if they know or can guess the report's UUID, then view and change information they were not originally allowed to access.

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. Version affected: <2.5.47.

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information, but after logging in with such a key, a specific MISP function could accidentally restore the user's normal account permissions. Version affected: <2.5.47.

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously.

MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied 'id' field before calling save(). Version affected: <2.5.47.

MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text.

MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. Sample tag names from unknown galaxy clusters are inserted into HTML without entity encoding, allowing a user with tag-editor privileges to inject malicious script. A site administrator viewing the Galaxies page executes that script in their browser session.

MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup, causing the embedded script to execute in the browser context of any user who opens the galaxy matrix statistics page.

MISP version ≤2.5.45 contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which renders MISP element references (attributes, objects, and tags) into inline HTML during PDF report export. User-controlled fields (attribute type and value, object name and relation, tag name and colours) are interpolated into HTML templates without HTML entity encoding. Additionally, the attribute() method contains hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, causing every plain attribute reference in a PDF to display the sample text rather than the actual indicator value.

An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.

In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.