MISP vulnerabilities

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.

The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination, and original request headers were reused, potentially forwarding authentication headers or API credentials to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results. The TAXII discovery endpoint had a related incomplete SSRF defense using gethostbyname() and comparing against only a few literal addresses, missing cases like IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null, which when passed to cURL effectively disabled TLS peer verification unless the calling code explicitly enabled it. As a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority.

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.

MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.

MISP contains an authentication bypass vulnerability when LDAP mixed authentication is enabled with OTP enforcement. An authenticated user can bypass the OTP step and access the application without providing a TOTP, HOTP, or email OTP code.

In MISP before version 2.4.187, the add_misp_export function in app/Controller/EventsController.php does not properly check for a valid file upload.

An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.

In app/Controller/AuditLogsController.php in MISP before version 2.4.182, ACLs for audit logs are mishandled.

An issue was discovered in MISP before version 2.4.176 related to mishandling parameter parsing in app/Controller/AppController.php.

An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.

MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.

In MISP version 2.4.144, the file app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp does not sanitize certain data related to generic-template:index.

The default setting of MISP 2.4.136 did not require providing the previous password when changing a password, which may lead to unauthorized changes.

An issue was discovered in MISP version 2.4.128 related to insufficient ACL checks in the attachment downloader in app/Controller/AttributesController.php.

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92 that allows an adversary to bypass brute-force protection. This can be done by using the PUT HTTP method instead of POST in the login part, as the protection only covered POST requests.

MISP contains a vulnerability in the handling of module plugin settings. When rebuilding module-supplied settings for API consumption, the server drops the redacted and cli_only flags declared in the module's configuration metadata, potentially exposing sensitive credentials and bypassing access restrictions.

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree, bypassing the redaction check. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys; affects versions <2.5.48.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels without output encoding, allowing injection of arbitrary HTML or JavaScript.

MISP contains a CSS injection vulnerability in the remote event preview feature. The colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation, allowing injection of arbitrary CSS declarations.

MISP versions below 2.5.48 contain a data integrity flaw in event deletion logic where associated records (report tags, graph entries, proposal correlations, ssdeep chunks, attachment scan results) are not removed and remain orphaned. These records may contain sensitive threat intelligence data and could be exposed through other access paths.

In MISP versions below 2.5.48, the event synchronization process contains a logic error in preparing event reports for remote push — filtering of non-exportable tags is applied only once after iterating over all reports rather than to each report. As a result, all reports except the last are pushed with non-exportable tags intact, disclosing restricted information, and when the last report is empty, a null report is pushed causing the remote instance to fail saving the event.

MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. This could lead to unauthorized disclosure of proposed attribute changes.

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data. Preconditions: Two or more MISP instances are configured to synchronize objects; a user with object-creation privileges creates an object without supplying a description; the object is subsequently synced to a peer instance. Impact: Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline. The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology. Affected: <2.5.48.

MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect. Preconditions: The target MISP instance has email OTP login enabled; the attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering); the attacker can issue two HTTP POST requests in close temporal proximity. Impact: The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions. This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted. Affected versions: <2.5.48.

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes, the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction. Preconditions: an authenticated MISP user with at least read access to an event owned by another organization, and the user issues a query for deleted attributes. Impact: Confidentiality: soft-deleted threat intelligence attributes from other organizations are disclosed to unauthorized users. Affected versions: MISP versions prior to v2.5.48.

MISP before version 2.5.48 has an authorization flaw in correlation handling during attribute searches. An authenticated user can access attributes and events they no longer have permission to view when an event has been restricted after correlation creation.

MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event. The correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open—because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded—were still returned with their metadata. Preconditions: an authenticated user with access to at least one event in MISP, and the existence of correlation entries linking that event to other events the user should not be able to view. Impact: unauthorized disclosure of event metadata and potential reconnaissance of threat-intelligence event names and timelines across sharing groups. Affected: MISP versions prior to the fix commit (2ffa97f05).

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints, the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields. An authenticated user with basic write permissions can exploit this to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim's browser.

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive, leading to PHP code execution.

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: API requests with no authentication key and requests supplying an API key with an incorrect length. Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Affects versions ≤2.5.45.

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. However, User->setupRedis() returns false when Redis cannot be reached, and the vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage. Affects versions ≤2.5.45.

Affected versions of MISP up to 2.5.45 can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time, causing AccessLog::logRequest() to be called twice for one HTTP request. The second write can overwrite the row created by the first, corrupting request duration, SQL query count, memory usage, and potentially the query log.

Affected versions of MISP up to 2.5.45 expose several state-changing controller actions without restricting them to POST. These actions include purgeUnusedPictures(), enableNoticelist(), removeOrphanedCorrelations(), and rebuildRedis(). An attacker can trigger these actions via ordinary GET requests, using an authenticated victim's session, potentially leading to unauthorized changes.

A vulnerability in MISP involves incorrect filtering of dashboard templates restricted to a specific permission flag. The listTemplates() function allowed a template when the permission flag matched the user's permissions or when the flag was 0. Because the field is a varchar, MySQL performed numeric coercion, causing strings like 'perm_site_admin' to be treated as 0, making restricted templates appear unrestricted.

In affected versions of MISP, a collection element can be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The add() path could persist a UUID for an Event or Galaxy Cluster that the caller could not normally read, making collections a way to reference another organisation's private data. The fix centralizes authorization in __assertCanUseElements(). Affected versions: ≤2.5.45.

In affected versions of MISP, a submitted sharing group is not authorized in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4; omitting distribution while supplying a different sharing_group_id skipped that check, and field-recovery logic restored the existing event distribution. The fix adds authorization checks in the controller and Event::_edit(). Affected versions: ≤2.5.45.

A vulnerability in MISP arises from relying on CakePHP's request-method override processing, which can disable CSRF and form-security validation. CakePHP honors the _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the standard verbs (POST, PUT, PATCH, DELETE), CakePHP clears the request body, causing MISP to skip _validatePost() and _validateCsrf(). An attacker can send a form with _method=GET to bypass protections.

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. Malicious scripts inside SVG can execute when the SVG is navigated to directly or embedded as a document, running on the MISP origin with the viewer's session. This affects organisation SVG logos and event-report SVG pictures. The vulnerable behavior is on the serve path, not merely the upload path. Version affected: ≤2.5.45.

Affected versions of MISP's interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45.

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:  - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45

MISP version <= 2.5.45 contains a CSRF vulnerability in UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were added to the unlockedActions list, disabling all CSRF validation (both token and field-hash checks) for those endpoints, allowing an attacker to forge requests that change a logged-in user's settings.

MISP in versions up to and including 2.5.45 does not consistently enforce the acting user's authorization when instantiating event templates. The instantiation path passed a template-specified sharing_group_id into event creation without verifying the user could use that sharing group, attached template-specified tags without checking tagging permissions, and hardcoded local => 0, allowing local_only tags to be attached globally and propagate through synchronization or export.

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format, causing the supplied value to be persisted more than once per request. The fix adds a maximum email input length of 1024 bytes, email-format validation, a per-source pre-authentication request budget, HTTP 429 responses, a 15-minute cooldown, and POST-only handling with CSRF protection.

MISP versions up to 2.5.45 allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The lack of parent-object ACL allows access to information outside the user's normal scope.

In MISP versions up to and including 2.5.45, several dashboard widgets displaying organisation information did not honor the Security.hide_organisation_index_from_users setting. Authenticated users without the perm_sharing_group permission could enumerate organisations that were normally hidden, and could also obtain additional database fields through JSON export. Additionally, a contributor leaderboard widget revealed all organisations with events, ignoring the same visibility setting.

MISP versions up to 2.5.45 insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The previous logic considered a URL safe if it appeared relative or hostname matched, but failed to reject dangerous schemes like javascript: or backslash-based URLs, leading to stored XSS.