Executive brief
MISP's security event reporting feature automatically decodes and processes XML requests without proper validation, allowing an unauthenticated attacker to trigger outbound HTTPS connections to arbitrary targets. An attacker can exploit this to probe internal services, trigger actions on internal systems, or gather network information about the server's environment, but cannot directly retrieve data from those services.
Technical details
The RequestHandlerComponent automatically decodes XML request bodies on write operations. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http || https), where PHP operator precedence causes https URLs to bypass the readFile check, enabling arbitrary URL fetching. The unauthenticated cspReport endpoint accepts XML content type, allowing an unauthenticated remote attacker to send a crafted POST request that triggers server-side HTTPS requests to internal or external services reachable from the MISP server.
Affected products
- MISP Project MISP prior to fix commit 716fc49d3
Timeline
- 2026-09-22: disclosed: Vulnerability published on NVD
- 2026-09-22: patched: Fix merged in MISP commit 716fc49d3 restricting XML decoding to actual documents