MISP vulnerabilities

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The endpoint returned fields including organisation ID, UUID, and name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations, allowing authenticated users to discover organisations that should have remained hidden. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Affected version: ≤2.5.45.

MISP versions up to 2.5.45 inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as type, key_data, and fingerprint, but did not fetch or authorize the associated parent event first. The fix adds parent_id and parent_type to the lookup and enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.

In MISP up to version 2.5.45, the validation of the user-configurable homepage only checks if the path starts with '/', which is insufficient. Protocol-relative URLs like '//attacker.example' also start with '/' but resolve to an external origin in browsers. The vulnerable homepage value can be stored and used in post-login routing.

In MISP versions up to 2.5.45, any authenticated user can access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypass allows low-privileged or read-only users to repeatedly upload files and consume server disk space. The fix changes the ACL requirement from * to perm_add.

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information to be exposed to users who could not otherwise access those events. The same preview functionality also returned cross-feed correlation information without properly restricting the feed list to feeds visible to the caller, exposing metadata for feeds not marked lookup_visible, and one affected response included the configured feed URL.

MISP's UiBeta collection view performs a secondary query of member events by UUID without applying the caller's ACL. An authenticated user with view access to a collection can retrieve full details of events they are not permitted to read, including identifiers, info, dates, timestamps, creator org, tags, and galaxy clusters.

A CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on REST request detection, which can be influenced by request properties like the Accept header. An attacker can craft cross-origin requests that are treated as REST traffic, bypassing CSRF protection for session-authenticated requests. The fix restricts exemptions to requests carrying a MISP API key and adds support for X-CSRF-Token header.

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out. As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource. Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation.

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions. The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event.

An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performed only when the request explicitly set the distribution field to 4 ("Sharing Group"). An attacker could therefore craft a request containing a sharing_group_id while omitting the distribution parameter, or otherwise avoiding the distribution == 4 condition, causing the Sharing Group authorization check to be skipped.

A vulnerability in MISP allows an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. By supplying a pre-encoded string instead of an array structure, an invalid definition can be persistently stored. On retrieval, invalid JSON triggers an exception, causing HTTP 500 errors in event template functionality.

MISP contains a session fixation vulnerability in the CustomAuth authentication flow. After successful authentication via CustomAuth, MISP stores the authenticated user identity in the existing session without first rotating the session identifier. An attacker who knows the victim's session identifier before authentication can later reuse it to access the victim's authenticated session.

A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection, enabling repeated guessing of OTP and potential bypass of the additional authentication factor.

A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. An attacker could cause an authenticated user with sufficient privileges to invoke the endpoint, leading to deletion of published empty events.

A persistent unsafe URL injection vulnerability was found in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only at render time and not when the configuration was saved, so an authenticated user able to modify widget settings could persist arbitrary URL values, including javascript: scheme URLs. The patch adds a canonical url schema type and validates widget configuration before it is persisted.

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. As a result, an authenticated user could receive correlation results referring to attributes or events that the user was not authorized to access.

A path traversal vulnerability in MISP during STIX 2 import and MISP-to-STIX 2 export. MISP object names were not sufficiently validated before being used in filesystem paths for template resolution, allowing escape from the template directory and loading a definition.json from another location. An attacker could supply a malicious object name (e.g., containing ../) via a custom STIX object or a persistent MISP event.

The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns `True` even when the embedded IPv4 targets a private, loopback, or cloud metadata destination. An attacker can register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint. The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects organisations running the HEAD.

The MISP Apache HTTP virtual-host configuration contains a malformed HTTP-to-HTTPS redirect missing a trailing slash in the destination URL. An attacker can exploit this to redirect users to a malicious site via a crafted HTTP request.

In MISP, the importModule() function used getEnabledModule() to resolve import modules by name but did not enforce per-organization restrictions. An authenticated user from a restricted organization could still invoke the module directly if they knew its name.

An authorization bypass in MISP's EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. The write path did not verify event modification rights when processing misp_standard format results.

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path, potentially leading to arbitrary code execution with the privileges of the MISP process.

MISP allows a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Due to the ability to inject PHP code by an attacker with administrator privileges, remote code execution may occur.

An authorization flaw in MISP's object add/edit handling allows an authenticated user with object editing permissions to assign an object or attributes to a sharing group they are not authorized to use. The sharing group validation was performed on the wrong data structure, bypassing the check.

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler, allowing an attacker to execute arbitrary JavaScript in the victim's browser.

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields, allowing an attacker to access files outside the intended directory.

MISP contains an insecure default configuration where the Security.check_sec_fetch_site_header control is disabled. This allows remote unauthenticated attackers to send malicious requests to MISP automation endpoints on behalf of authenticated users.

MISP has an incorrect authorization vulnerability that allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality. The affected code restricted organization administrators to users within their own organization but did not exclude site administrator role accounts from recipient queries.

In MISP, an improper authorization vulnerability allowed an organization administrator to access user settings belonging to site administrator accounts within the same organization. The access control checks did not exclude higher-privileged site administrator users, enabling modification of site administrator account settings.

A vulnerability in MISP dashboard widgets allowed an authenticated user to manipulate the 'fields' option and influence which fields were returned by the 'New Users' and 'New Organisations' widgets. Requesting an empty field set could cause the query to return unintended model fields, including user email addresses even when disclosure was disabled.

In the over-correlations endpoint of MISP, the order parameter was accepted from user-controlled request parameters, allowing an authenticated attacker to override server-side ordering. This could lead to database query manipulation.

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks.

An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com.

A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. An attacker could configure a dashboard button that appears to point inside the application but redirects users to an attacker-controlled site.

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. An authenticated user could forcibly overwrite an event template owned by another organization.

A visibility control issue in the event template creation workflow in MISP allowed non-site-admin users to access private galaxies belonging to other organizations. The event template builder loaded all enabled galaxies without applying organization or distribution-based access restrictions.

The CSP report endpoint in MISP intended to limit reports to 1 KB but incorrectly accepted reports up to 1 MB before truncation. If reachable by untrusted clients, attackers can generate excessive logs, leading to resource exhaustion or log flooding.

In MISP up to version 2.5.38, the ShadowAttribute proposal creation workflow accepted the 'id' field from the client, allowing authenticated users to update existing attributes instead of creating new proposals. This can lead to unauthorized data modification.

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

In MISP, prior to version 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. An attacker could craft a malicious ordering parameter to manipulate the generated SQL query.

MISP is a threat intelligence management platform. In versions prior to 2.5.37, there was a vulnerability related to improper access control in the authentication key reset functionality, allowing organization administrators to reset keys for site administrator accounts within the same organization.

app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.

In MISP before version 2.4.193, the menu_custom_right_link_html parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks on every page.

In MISP before version 2.4.193, the menu_custom_right_link parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks through a global menu link.

In MISP before version 2.4.198, the app/Model/Attribute.php file ignores ACL rules during a GUI attribute search.

An issue was discovered in MISP version 2.4.174 related to a reflected XSS vulnerability. The issue exists in app/Controller/DashboardsController.php via the id parameter during dashboard editing.

MISP version 2.4.174 allows XSS in app/View/Events/index.ctp.

In MISP before version 2.4.172, the title_for_layout parameter is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.