Executive brief
MISP is a threat intelligence platform used by organizations to share and analyze security events. The vulnerability allows attackers to bypass CSRF and form-validation protections by sending requests with specially crafted HTTP method override parameters, potentially enabling unauthorized actions on the platform without proper security checks.
Technical details
MISP relies on CakePHP's request-method override processing (via _method field or X-HTTP-Method-Override header) combined with its security component. When CakePHP processes override values outside the normal write verbs (POST, PUT, PATCH, DELETE), it clears the parsed request body. MISP's security component then skips _validatePost() and _validateCsrf() checks if no request data remains. An attacker can craft a cross-site request with _method=GET to empty the body before validation, bypassing both CSRF and form-security protections. This allows reaching actions whose parameters are taken from the URL. The vulnerability affects MISP ≤2.5.45 and was fixed by validating method overrides in commit 29af008c4, which rejects overrides outside the allowed write verbs.
Affected products
- MISP Project MISP ≤2.5.45
Timeline
- 2026-09-15: disclosed
- 2026-08-19: patched: Fix committed as internal review finding