Executive brief
A security vulnerability exists in the MISP threat intelligence platform when using the Overmind theme. An attacker can inject malicious code into the 'homepage' setting, which is then executed in the browsers of other users when they click a specific link. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in MISP when the Overmind theme is active. The 'setHomePage' endpoint utilized 'setSettingInternal()', which bypassed standard validation logic (validate_homepage) that typically enforces paths starting with a forward slash. This allowed an authenticated user to save an arbitrary string, including JavaScript payloads, as their homepage path. The payload is subsequently rendered without HTML escaping in the 'href' attribute of the 'Continue to homepage' link within 'app/View/News/index.ctp'. An exploit is triggered when a user interacts with the crafted link. The issue has been addressed by routing the setting through the standard 'setSetting()' method to ensure validation and by implementing proper HTML escaping during rendering.
Affected products
- MISP Project MISP
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory