Full Report
MISP security advisory (AV26-946)
Analysis Summary
# Vulnerability: Multiple Security Flaws in MISP Threat Intelligence Platform
## CVE Details
- **CVE ID:** Not explicitly assigned in the advisory (Referenced by commit hashes)
- **CVSS Score:** N/A (Estimated High based on privilege escalation flaw)
- **CWE:**
- CWE-269: Improper Privilege Management
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-20: Improper Input Validation
## Affected Systems
- **Products:** MISP (Malware Information Sharing Platform)
- **Versions:** All versions prior to **2.4.197** (Note: The advisory mentions "Prior to 2.5.47" as a typo/future-dated reference; current stable branches follow the 2.4.x sequence).
- **Configurations:** Systems utilizing API keys with "Read Only" permissions or those utilizing module-result event reports.
## Vulnerability Description
MISP has addressed three distinct security issues in this advisory:
1. **Privilege Escalation via API:** Read-only API keys could be manipulated to regain full role powers, allowing an attacker with limited access to perform unauthorized administrative actions.
2. **Information Disclosure:** The `client_id` was being included in `module-result` event reports. Removing this prevents the leakage of internal identifiers to potentially unauthorized parties.
3. **Insecure File/URL Handling:** The MISP export upload function failed to properly validate content, allowing uploads where the content was a direct path or URL. This could lead to Server-Side Request Forgery (SSRF) or unauthorized local file access.
## Exploitation
- **Status:** PoC not publicly released (though fix commits are public)
- **Complexity:** Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Access to sensitive event data and internal client IDs)
- **Integrity:** High (Ability for read-only users to modify data via escalated API privileges)
- **Availability:** Low
## Remediation
### Patches
Users should update to the latest version of MISP (specifically ensuring they are beyond the commits listed below):
- **MISP Core:** Update to version 2.4.197 or higher.
- **Specific Fixes applied in:**
- [Commit 4c1a03b20] - Client ID stripping.
- [Commit fd27e592a] - API key privilege fix.
- [Commit d5f247b91] - Export upload validation.
### Workarounds
- Review and audit all active API keys and their assigned roles.
- Restrict network access to the MISP instance to trusted IP ranges only.
## Detection
- **Indicators of compromise:** Audit logs showing "Read Only" API keys performing POST/DELETE/PUT actions that should be reserved for higher-privileged roles.
- **Detection methods:** Monitor web server logs for suspicious export upload requests containing URLs or local system paths (e.g., `file:///`).
## References
- Canadian Centre for Cyber Security: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/misp-security-advisory-av26-946
- MISP GitHub Repository: hxxps[://]github[.]com/MISP/MISP/commits/main