Executive brief
MISP is an open-source platform used by organizations to share and analyze threat intelligence. A security flaw in how the platform handles data sorting requests could allow an attacker to interfere with the underlying database. This could lead to unauthorized access to sensitive intelligence data, modification of records, or disruption of the platform's operations.
Technical details
A SQL injection vulnerability (CWE-89) exists in MISP's event and shadow attribute listing endpoints due to improper validation of user-supplied 'order' or 'sort' parameters. The application directly incorporated these request parameters into database query ORDER BY clauses. A remote attacker can exploit this by crafting malicious ordering parameters to manipulate SQL queries. Depending on database configuration, this may allow for unauthorized data extraction or modification. The vulnerability is resolved in version 2.5.37 by implementing strict validation against allowed model fields and normalizing sort directions.
Affected products
- MISP Project MISP < 2.5.37
Timeline
- 2026-04-29: advisory: Initial GitHub security advisory published
- 2026-05-13: disclosed: NVD publication date
- 2026-05-13: patched: Fixed in version 2.5.37