Executive brief
MISP, a threat intelligence sharing platform used by organizations to coordinate on security threats, contains a cross-site request forgery (CSRF) flaw that allows attackers to silently modify threat data through a logged-in user's browser. An attacker can craft a malicious webpage that, when visited by an authenticated MISP user, modifies attributes such as indicator values, types, categories, or distribution settings without the user's knowledge or consent. This could lead to corruption of threat intelligence, incorrect security decisions, and reduced trust in the shared information.
Technical details
The vulnerability is a CSRF flaw in the attributes/editField endpoint, which was whitelisted in unlockedActions and therefore bypassed MISP's CSRF token validation. An attacker can craft a cross-site request carrying only the victim's session cookie to rewrite attribute properties (value, type, category, comment, to_ids, distribution, first_seen, last_seen). The attack requires the victim to be authenticated to MISP and to visit an attacker-controlled page; the fix applies the same CSRF token handling (X-CSRF-Token header or body parameter) as other AJAX endpoints in the controller.
Affected products
- MISP Project MISP <2.5.47
Timeline
- 2026-09-21: disclosed