Executive brief
A security vulnerability was identified in MISP, an open-source threat intelligence platform used by organizations to share and analyze cyber threat data. An authenticated user could manipulate how data is sorted within the application's correlation engine by providing custom database instructions. While the immediate impact is limited to changing the order of displayed results, such manipulation can sometimes be used to bypass security filters or gain unauthorized insights into the underlying database structure.
Technical details
An improper input validation vulnerability (CWE-20) exists in MISP's CorrelationsController.php within the overCorrelations() function. The application previously allowed the 'order' query parameter to be accepted directly from user-controlled named request parameters. An authenticated attacker with high privileges can exploit this to override server-defined SQL ordering clauses. While the primary impact is query manipulation, it potentially exposes the application to unsafe query construction depending on the underlying data access layer's handling of the parameter. The issue has been addressed in commit aa094a3 by hardcoding the ordering to 'occurrence desc' server-side after processing other allowed parameters.
Affected products
- MISP Project MISP Prior to commit aa094a3
Timeline
- 2026-06-04: disclosed
- 2026-06-04: advisory