Executive brief
MISP is a threat intelligence platform used by security teams to manage and share indicator data. An improper configuration in the WorkflowsController allowed attackers to bypass CSRF protection on a critical action that executes workflow modules. An authenticated administrator tricked into visiting a malicious website could have their browser execute arbitrary workflow modules on the MISP instance, including modules that modify security blocklists and warning lists without authorization.
Technical details
The moduleStatelessExecution action was listed in CakePHP's Security component unlockedActions, which disables CSRF token validation. Because the action accepts caller-supplied input and parameters to execute arbitrary workflow modules—including action modules that write to blocklists and warninglists—an attacker could craft a cross-site form post that, when submitted by an authenticated administrator, would execute malicious modules with attacker-controlled input. The vulnerability was fixed in MISP v2.5.47 by removing the action from unlockedActions and implementing proper CSRF token handling via X-CSRF-Token headers.
Affected products
- MISP MISP before 2.5.47
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fix included in MISP v2.5.47