Executive brief
MISP is a threat intelligence platform used to manage and share malware, indicators, and security events. A vulnerability in its STIX import functionality allows attackers to supply crafted threat intelligence documents that inject or modify sensitive metadata (distribution settings, classification tags, sharing restrictions) on imported attributes, potentially causing data to be shared beyond intended recipients or with wrong classifications.
Technical details
The vulnerability involves two logic flaws in misp-stix: (1) automatic parser selection based on untrusted STIX document metadata (MISP-specific labels or titles), allowing an attacker to spoof the document origin, and (2) insufficient input validation when converting STIX2 x-misp-object attributes to MISP objects. When handling STIX2 content classified as internal MISP exports, the code directly copies all fields from the x_misp_attributes dictionary without restricting to expected attributes, enabling injection of security-sensitive properties (distribution, sharing_group_id, tags). An attacker who can provide a STIX document for import can exploit this to alter attribute metadata and bypass distribution policies. The issue is tracked as CWE-915 (improper control of dynamically managed code) and CWE-807 (reliance on untrusted inputs in security decisions), with remediation via an allow-list of permitted attributes.
Affected products
- MISP misp-stix
Timeline
- 2026-08-21: disclosed