MISP patches command injection in STIX import
MISP 2.4.99 fixes a critical command injection vulnerability (CVE-2018-19908) in its STIX 1 import feature that could be exploited by authenticated users.
Sourcemisp-project.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2018-19908 (poc); no exploitation in the wild is recorded.
MISP, the open-source threat intelligence sharing platform, released version 2.4.99 addressing a critical security vulnerability in its STIX 1 import functionality. The flaw, reported by Francois-Xavier Stellamans of NCI Agency Cyber Security, stemmed from an incorrectly escaped variable containing the original filename of an uploaded STIX file, allowing an authenticated malicious user to inject and execute arbitrary commands on the server hosting MISP.
To remediate the issue, the MISP project replaced the previous mechanism of storing uploaded files and passing them to external tools with a standardized processing function designed to prevent similar injection vulnerabilities from being introduced through future ingestion mechanisms. The release also includes numerous non-security improvements, including new attribute types for x509 certificate fingerprints, UI warning fixes, API corrections for object editing, and enhancements to STIX 1 and STIX 2.0 import handling. Users running MISP instances are strongly urged to upgrade to 2.4.99 to remediate the vulnerability.
Mentioned in this report
Detection guidance
External Tool Execution from MISP with Unsanitized Input
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects MISP spawning external utilities (tar, unzip, etc.) with arguments derived from user-supplied filenames without proper escaping. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External Tool Execution from MISP with Unsanitized Input
description: Detects MISP processes invoking external utilities (archive extractors,
XML processors) with filename arguments that may contain injection payloads. Targets
the vulnerable pattern where uploaded STIX filenames are passed directly to command-line
tools.
tags:
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_misp_context:
ParentImage|contains:
- misp
- php-cgi
- httpd
selection_external_tools:
Image|endswith:
- \tar.exe
- \unzip.exe
- \7z.exe
- \python.exe
- \perl.exe
selection_suspicious_args:
CommandLine|contains:
- .stix
- .xml
CommandLine|re: .*[\$`|;&><].*\.(?:stix|xml)
condition: selection_misp_context and selection_external_tools and selection_suspicious_args
falsepositives:
- Legitimate MISP post-processing workflows extracting or parsing STIX archives
- Admin scripts intentionally using shell operators in import pipelines
level: medium
id: e35b73d4-1fcf-5e00-965e-714374c4194b
status: experimental
author: Vorant
MISP Process Spawning Interactive Shell with Filename Context
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects MISP-related processes launching interactive shells (bash, cmd) where the command line references uploaded filenames or import operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP Process Spawning Interactive Shell with Filename Context
description: Detects MISP or PHP processes invoking interactive command shells in
the context of STIX/import operations with attacker-controlled filename references,
suggesting command injection exploitation.
tags:
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_misp_shell:
ParentImage|contains:
- misp
- php
Image|endswith:
- \cmd.exe
- \powershell.exe
CommandLine|contains:
- '/c '
- '/s '
- -Command
selection_import_context:
CommandLine|contains:
- stix
- import
- upload
filter_legitimate:
CommandLine|contains:
- 'echo '
- 'type '
condition: selection_misp_shell and selection_import_context and not filter_legitimate
falsepositives:
- MISP debugging or logging commands that spawn shells for diagnostic output
level: medium
id: a405c410-fd9e-5661-affb-94c81dae1346
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.misp-project.org/2018/12/06/misp.2.4.99.released.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs