MISP vulnerabilities

In the over-correlations endpoint of MISP, the order parameter was accepted from user-controlled request parameters, allowing an authenticated attacker to override server-side ordering. This could lead to database query manipulation.

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks.

An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com.

A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. An attacker could configure a dashboard button that appears to point inside the application but redirects users to an attacker-controlled site.

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. An authenticated user could forcibly overwrite an event template owned by another organization.

A visibility control issue in the event template creation workflow in MISP allowed non-site-admin users to access private galaxies belonging to other organizations. The event template builder loaded all enabled galaxies without applying organization or distribution-based access restrictions.

The CSP report endpoint in MISP intended to limit reports to 1 KB but incorrectly accepted reports up to 1 MB before truncation. If reachable by untrusted clients, attackers can generate excessive logs, leading to resource exhaustion or log flooding.

In MISP up to version 2.5.38, the ShadowAttribute proposal creation workflow accepted the 'id' field from the client, allowing authenticated users to update existing attributes instead of creating new proposals. This can lead to unauthorized data modification.

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

In MISP, prior to version 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. An attacker could craft a malicious ordering parameter to manipulate the generated SQL query.

MISP is a threat intelligence management platform. In versions prior to 2.5.37, there was a vulnerability related to improper access control in the authentication key reset functionality, allowing organization administrators to reset keys for site administrator accounts within the same organization.

In MISP before version 2.4.193, the menu_custom_right_link_html parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks on every page.

In MISP before version 2.4.193, the menu_custom_right_link parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks through a global menu link.

In MISP before version 2.4.198, the app/Model/Attribute.php file ignores ACL rules during a GUI attribute search.

An issue was discovered in MISP version 2.4.174 related to a reflected XSS vulnerability. The issue exists in app/Controller/DashboardsController.php via the id parameter during dashboard editing.

MISP version 2.4.174 allows XSS in app/View/Events/index.ctp.

In MISP before version 2.4.172, the title_for_layout parameter is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.

MISP version 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information due to the nature of the error messages.

In MISP version 2.4.169, the file app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.

The js/event-graph.js file in MISP before version 2.4.169 is vulnerable to XSS via event-graph node tooltips.

In MISP version 2.4.167, there is an XSS vulnerability that allows an attack via a network history name in the app/webroot/js/action_table.js file.

In MISP before version 2.4.167, there is an XSS vulnerability in the template file uploads in app/View/Templates/upload_file.ctp.

In app/Controller/UsersController.php in MISP before version 2.4.164, there is a vulnerability that allows attackers to discover role names, which should only be accessible to the site administrator.

An issue was discovered in MISP before version 2.4.158 that allows password confirmation to be bypassed in UsersController.php via an 'Accept: application/json' header.

An issue was discovered in MISP before version 2.4.158 related to XSS in app/Controller/OrganisationsController.php occurring in a situation with a 'weird single checkbox page.'

An issue was discovered in MISP before version 2.4.158 related to XSS in the cerebrate view. If one administrator inputs a javascript: URL in the URL field and another administrator clicks on it, it may lead to unauthorized script execution.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in the event graph via a tag name.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in galaxy clusters.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in the LinOTP login field.

An issue was discovered in MISP before version 2.4.156 related to the SVG org logo, which does not forbid the use of JavaScript by default.

An issue was discovered in MISP before version 2.4.156, allowing a malicious site administrator to store an XSS payload in the custom auth name. This payload would be executed each time the administrator modifies a user.

An issue was discovered in MISP before version 2.4.156 that allows Local File Inclusion via the custom terms file setting in app/View/Users/terms.ctp.

In MISP version 2.4.147, there is a Stored XSS vulnerability in app/View/GalaxyElements/ajax/index.ctp that can be exploited when viewing galaxy cluster elements in JSON format.

In MISP version 2.4.147, there is a stored XSS vulnerability in the view_relation_tree.ctp file, allowing malicious code execution when viewing galaxy cluster relationships.

In MISP 2.4.141 in app/Model/MispObject.php, an incorrect sharing group association could lead to information disclosure on an event edit. Instead of using the sharing group object, the passed local ID is reused.

An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.

A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in the SetHomePage() function in app/Controller/UserSettingsController.php. Due to a lack of controller validation in the 'path' parameter, an attacker can execute malicious JavaScript code.

MISP version 2.4.136 has an XSS vulnerability that can be exploited via a crafted URL to the user homepage favourite button in app/View/Elements/global_menu.ctp.

MISP version 2.4.136 has an XSS vulnerability via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.

MISP version 2.4.136 has a Stored XSS vulnerability in the galaxy cluster view that can be exploited via a cluster name in app/View/GalaxyClusters/view.ctp.

In MISP version 2.4.134, there is an XSS vulnerability in the template element index view due to mishandling of the id parameter.

MISP versions up to 2.4.133 allows SSRF (Server-Side Request Forgery) in the REST client via the use_full_path parameter with an arbitrary URL.

An issue was discovered in MISP before 2.4.132 that allows for an unwanted action due to a POST operation on a form not linked to the login page.

In MISP before version 2.4.129, setting a favourite homepage was not protected against CSRF attacks.

An issue was discovered in MISP version 2.4.128, where app/Controller/EventsController.php lacks an event ACL check before allowing a user to send an event contact form.

MISP version 2.4.127 lacks an ACL check on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute.

An issue was discovered in MISP before version 2.4.121 where ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.

An issue was discovered in MISP before version 2.4.121 related to an incorrectly sanitized search string in the Galaxy view in app/View/Galaxies/view.ctp.

An issue was discovered in MISP before version 2.4.121 that did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.

An issue was discovered in MISP before version 2.4.121, which did not canonicalize usernames when trying to block a brute-force series of invalid requests.