MISP vulnerabilities

An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.

In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.

MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.

MISP contains an authentication bypass vulnerability when LDAP mixed authentication is enabled with OTP enforcement. An authenticated user can bypass the OTP step and access the application without providing a TOTP, HOTP, or email OTP code.

In MISP before version 2.4.187, the add_misp_export function in app/Controller/EventsController.php does not properly check for a valid file upload.

An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.

In app/Controller/AuditLogsController.php in MISP before version 2.4.182, ACLs for audit logs are mishandled.

An issue was discovered in MISP before version 2.4.176 related to mishandling parameter parsing in app/Controller/AppController.php.

An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.

MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.

In MISP version 2.4.144, the file app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp does not sanitize certain data related to generic-template:index.

The default setting of MISP 2.4.136 did not require providing the previous password when changing a password, which may lead to unauthorized changes.

An issue was discovered in MISP version 2.4.128 related to insufficient ACL checks in the attachment downloader in app/Controller/AttributesController.php.

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92 that allows an adversary to bypass brute-force protection. This can be done by using the PUT HTTP method instead of POST in the login part, as the protection only covered POST requests.

A path traversal vulnerability in MISP during STIX 2 import and MISP-to-STIX 2 export. MISP object names were not sufficiently validated before being used in filesystem paths for template resolution, allowing escape from the template directory and loading a definition.json from another location. An attacker could supply a malicious object name (e.g., containing ../) via a custom STIX object or a persistent MISP event.

The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns `True` even when the embedded IPv4 targets a private, loopback, or cloud metadata destination. An attacker can register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint. The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects organisations running the HEAD.

The MISP Apache HTTP virtual-host configuration contains a malformed HTTP-to-HTTPS redirect missing a trailing slash in the destination URL. An attacker can exploit this to redirect users to a malicious site via a crafted HTTP request.

In MISP, the importModule() function used getEnabledModule() to resolve import modules by name but did not enforce per-organization restrictions. An authenticated user from a restricted organization could still invoke the module directly if they knew its name.

An authorization bypass in MISP's EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. The write path did not verify event modification rights when processing misp_standard format results.

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path, potentially leading to arbitrary code execution with the privileges of the MISP process.

MISP allows a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Due to the ability to inject PHP code by an attacker with administrator privileges, remote code execution may occur.

An authorization flaw in MISP's object add/edit handling allows an authenticated user with object editing permissions to assign an object or attributes to a sharing group they are not authorized to use. The sharing group validation was performed on the wrong data structure, bypassing the check.

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler, allowing an attacker to execute arbitrary JavaScript in the victim's browser.

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields, allowing an attacker to access files outside the intended directory.

MISP contains an insecure default configuration where the Security.check_sec_fetch_site_header control is disabled. This allows remote unauthenticated attackers to send malicious requests to MISP automation endpoints on behalf of authenticated users.

MISP has an incorrect authorization vulnerability that allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality. The affected code restricted organization administrators to users within their own organization but did not exclude site administrator role accounts from recipient queries.

In MISP, an improper authorization vulnerability allowed an organization administrator to access user settings belonging to site administrator accounts within the same organization. The access control checks did not exclude higher-privileged site administrator users, enabling modification of site administrator account settings.

A vulnerability in MISP dashboard widgets allowed an authenticated user to manipulate the 'fields' option and influence which fields were returned by the 'New Users' and 'New Organisations' widgets. Requesting an empty field set could cause the query to return unintended model fields, including user email addresses even when disclosure was disabled.

In the over-correlations endpoint of MISP, the order parameter was accepted from user-controlled request parameters, allowing an authenticated attacker to override server-side ordering. This could lead to database query manipulation.

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks.

An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com.

A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. An attacker could configure a dashboard button that appears to point inside the application but redirects users to an attacker-controlled site.

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. An authenticated user could forcibly overwrite an event template owned by another organization.

A visibility control issue in the event template creation workflow in MISP allowed non-site-admin users to access private galaxies belonging to other organizations. The event template builder loaded all enabled galaxies without applying organization or distribution-based access restrictions.

The CSP report endpoint in MISP intended to limit reports to 1 KB but incorrectly accepted reports up to 1 MB before truncation. If reachable by untrusted clients, attackers can generate excessive logs, leading to resource exhaustion or log flooding.

In MISP up to version 2.5.38, the ShadowAttribute proposal creation workflow accepted the 'id' field from the client, allowing authenticated users to update existing attributes instead of creating new proposals. This can lead to unauthorized data modification.

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

In MISP, prior to version 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. An attacker could craft a malicious ordering parameter to manipulate the generated SQL query.

MISP is a threat intelligence management platform. In versions prior to 2.5.37, there was a vulnerability related to improper access control in the authentication key reset functionality, allowing organization administrators to reset keys for site administrator accounts within the same organization.

In MISP before version 2.4.193, the menu_custom_right_link_html parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks on every page.

In MISP before version 2.4.193, the menu_custom_right_link parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks through a global menu link.

In MISP before version 2.4.198, the app/Model/Attribute.php file ignores ACL rules during a GUI attribute search.

An issue was discovered in MISP version 2.4.174 related to a reflected XSS vulnerability. The issue exists in app/Controller/DashboardsController.php via the id parameter during dashboard editing.

MISP version 2.4.174 allows XSS in app/View/Events/index.ctp.

In MISP before version 2.4.172, the title_for_layout parameter is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.

MISP version 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information due to the nature of the error messages.

In MISP version 2.4.169, the file app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.

The js/event-graph.js file in MISP before version 2.4.169 is vulnerable to XSS via event-graph node tooltips.

In MISP version 2.4.167, there is an XSS vulnerability that allows an attack via a network history name in the app/webroot/js/action_table.js file.

In MISP before version 2.4.167, there is an XSS vulnerability in the template file uploads in app/View/Templates/upload_file.ctp.