Executive brief
MISP is an open-source platform used by organizations to share and analyze threat intelligence. A security flaw in its authentication module allows attackers to manipulate login queries when the system is configured behind certain proxy setups. This could allow an unauthorized user to bypass security checks, gain access to the platform, or perform unauthorized searches within the organization's directory service.
Technical details
An LDAP injection vulnerability exists in MISP's ApacheAuthenticate.php component due to improper neutralization of special elements in LDAP queries. The flaw is triggered when the 'ApacheAuthenticate.apacheEnv' setting is configured to use a user-controlled server variable (common in specific proxy configurations) instead of the standard REMOTE_USER. An unauthenticated remote attacker can provide a specially crafted username to manipulate the LDAP search filter. This can lead to authentication bypass or the execution of unauthorized LDAP queries. The issue was resolved in version 2.5.36 by implementing proper LDAP escaping using ldap_escape().
Affected products
- MISP Project MISP < 2.5.36
Timeline
- 2026-04-03: patched: Version 2.5.36 released
- 2026-04-08: advisory: GitHub Security Advisory published
- 2026-04-09: disclosed: CVE published to NVD