MISP vulnerabilities

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.

The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination, and original request headers were reused, potentially forwarding authentication headers or API credentials to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results. The TAXII discovery endpoint had a related incomplete SSRF defense using gethostbyname() and comparing against only a few literal addresses, missing cases like IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null, which when passed to cURL effectively disabled TLS peer verification unless the calling code explicitly enabled it. As a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority.

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.

MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.

MISP contains an authentication bypass vulnerability when LDAP mixed authentication is enabled with OTP enforcement. An authenticated user can bypass the OTP step and access the application without providing a TOTP, HOTP, or email OTP code.

In MISP before version 2.4.187, the add_misp_export function in app/Controller/EventsController.php does not properly check for a valid file upload.

An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.

In app/Controller/AuditLogsController.php in MISP before version 2.4.182, ACLs for audit logs are mishandled.

An issue was discovered in MISP before version 2.4.176 related to mishandling parameter parsing in app/Controller/AppController.php.

An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.

MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.

In MISP version 2.4.144, the file app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp does not sanitize certain data related to generic-template:index.

The default setting of MISP 2.4.136 did not require providing the previous password when changing a password, which may lead to unauthorized changes.

An issue was discovered in MISP version 2.4.128 related to insufficient ACL checks in the attachment downloader in app/Controller/AttributesController.php.

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92 that allows an adversary to bypass brute-force protection. This can be done by using the PUT HTTP method instead of POST in the login part, as the protection only covered POST requests.

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data. Preconditions: Two or more MISP instances are configured to synchronize objects; a user with object-creation privileges creates an object without supplying a description; the object is subsequently synced to a peer instance. Impact: Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline. The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology. Affected: <2.5.48.

MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect. Preconditions: The target MISP instance has email OTP login enabled; the attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering); the attacker can issue two HTTP POST requests in close temporal proximity. Impact: The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions. This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted. Affected versions: <2.5.48.

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes, the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction. Preconditions: an authenticated MISP user with at least read access to an event owned by another organization, and the user issues a query for deleted attributes. Impact: Confidentiality: soft-deleted threat intelligence attributes from other organizations are disclosed to unauthorized users. Affected versions: MISP versions prior to v2.5.48.

MISP before version 2.5.48 has an authorization flaw in correlation handling during attribute searches. An authenticated user can access attributes and events they no longer have permission to view when an event has been restricted after correlation creation.

MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event. The correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open—because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded—were still returned with their metadata. Preconditions: an authenticated user with access to at least one event in MISP, and the existence of correlation entries linking that event to other events the user should not be able to view. Impact: unauthorized disclosure of event metadata and potential reconnaissance of threat-intelligence event names and timelines across sharing groups. Affected: MISP versions prior to the fix commit (2ffa97f05).

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints, the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields. An authenticated user with basic write permissions can exploit this to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim's browser.

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive, leading to PHP code execution.

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: API requests with no authentication key and requests supplying an API key with an incorrect length. Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Affects versions ≤2.5.45.

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. However, User->setupRedis() returns false when Redis cannot be reached, and the vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage. Affects versions ≤2.5.45.

Affected versions of MISP up to 2.5.45 can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time, causing AccessLog::logRequest() to be called twice for one HTTP request. The second write can overwrite the row created by the first, corrupting request duration, SQL query count, memory usage, and potentially the query log.

Affected versions of MISP up to 2.5.45 expose several state-changing controller actions without restricting them to POST. These actions include purgeUnusedPictures(), enableNoticelist(), removeOrphanedCorrelations(), and rebuildRedis(). An attacker can trigger these actions via ordinary GET requests, using an authenticated victim's session, potentially leading to unauthorized changes.

A vulnerability in MISP involves incorrect filtering of dashboard templates restricted to a specific permission flag. The listTemplates() function allowed a template when the permission flag matched the user's permissions or when the flag was 0. Because the field is a varchar, MySQL performed numeric coercion, causing strings like 'perm_site_admin' to be treated as 0, making restricted templates appear unrestricted.

In affected versions of MISP, a collection element can be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The add() path could persist a UUID for an Event or Galaxy Cluster that the caller could not normally read, making collections a way to reference another organisation's private data. The fix centralizes authorization in __assertCanUseElements(). Affected versions: ≤2.5.45.

In affected versions of MISP, a submitted sharing group is not authorized in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4; omitting distribution while supplying a different sharing_group_id skipped that check, and field-recovery logic restored the existing event distribution. The fix adds authorization checks in the controller and Event::_edit(). Affected versions: ≤2.5.45.

A vulnerability in MISP arises from relying on CakePHP's request-method override processing, which can disable CSRF and form-security validation. CakePHP honors the _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the standard verbs (POST, PUT, PATCH, DELETE), CakePHP clears the request body, causing MISP to skip _validatePost() and _validateCsrf(). An attacker can send a form with _method=GET to bypass protections.

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. Malicious scripts inside SVG can execute when the SVG is navigated to directly or embedded as a document, running on the MISP origin with the viewer's session. This affects organisation SVG logos and event-report SVG pictures. The vulnerable behavior is on the serve path, not merely the upload path. Version affected: ≤2.5.45.

Affected versions of MISP's interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45.

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:  - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45

MISP version <= 2.5.45 contains a CSRF vulnerability in UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were added to the unlockedActions list, disabling all CSRF validation (both token and field-hash checks) for those endpoints, allowing an attacker to forge requests that change a logged-in user's settings.

MISP in versions up to and including 2.5.45 does not consistently enforce the acting user's authorization when instantiating event templates. The instantiation path passed a template-specified sharing_group_id into event creation without verifying the user could use that sharing group, attached template-specified tags without checking tagging permissions, and hardcoded local => 0, allowing local_only tags to be attached globally and propagate through synchronization or export.

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format, causing the supplied value to be persisted more than once per request. The fix adds a maximum email input length of 1024 bytes, email-format validation, a per-source pre-authentication request budget, HTTP 429 responses, a 15-minute cooldown, and POST-only handling with CSRF protection.

MISP versions up to 2.5.45 allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The lack of parent-object ACL allows access to information outside the user's normal scope.

In MISP versions up to and including 2.5.45, several dashboard widgets displaying organisation information did not honor the Security.hide_organisation_index_from_users setting. Authenticated users without the perm_sharing_group permission could enumerate organisations that were normally hidden, and could also obtain additional database fields through JSON export. Additionally, a contributor leaderboard widget revealed all organisations with events, ignoring the same visibility setting.

MISP versions up to 2.5.45 insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The previous logic considered a URL safe if it appeared relative or hostname matched, but failed to reject dangerous schemes like javascript: or backslash-based URLs, leading to stored XSS.

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The endpoint returned fields including organisation ID, UUID, and name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations, allowing authenticated users to discover organisations that should have remained hidden. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Affected version: ≤2.5.45.

MISP versions up to 2.5.45 inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as type, key_data, and fingerprint, but did not fetch or authorize the associated parent event first. The fix adds parent_id and parent_type to the lookup and enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.

In MISP up to version 2.5.45, the validation of the user-configurable homepage only checks if the path starts with '/', which is insufficient. Protocol-relative URLs like '//attacker.example' also start with '/' but resolve to an external origin in browsers. The vulnerable homepage value can be stored and used in post-login routing.

In MISP versions up to 2.5.45, any authenticated user can access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypass allows low-privileged or read-only users to repeatedly upload files and consume server disk space. The fix changes the ACL requirement from * to perm_add.

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information to be exposed to users who could not otherwise access those events. The same preview functionality also returned cross-feed correlation information without properly restricting the feed list to feeds visible to the caller, exposing metadata for feeds not marked lookup_visible, and one affected response included the configured feed URL.

MISP's UiBeta collection view performs a secondary query of member events by UUID without applying the caller's ACL. An authenticated user with view access to a collection can retrieve full details of events they are not permitted to read, including identifiers, info, dates, timestamps, creator org, tags, and galaxy clusters.