MISP patches command injection in STIX import

6 December 2018 routine vulnerability

MISP 2.4.99 fixes a critical command injection vulnerability (CVE-2018-19908) in its STIX 1 import feature that could be exploited by authenticated users.

MISP, the open-source threat intelligence sharing platform, released version 2.4.99 addressing a critical security vulnerability in its STIX 1 import functionality. The flaw, reported by Francois-Xavier Stellamans of NCI Agency Cyber Security, stemmed from an incorrectly escaped variable containing the original filename of an uploaded STIX file, allowing an authenticated malicious user to inject and execute arbitrary commands on the server hosting MISP.

To remediate the issue, the MISP project replaced the previous mechanism of storing uploaded files and passing them to external tools with a standardized processing function designed to prevent similar injection vulnerabilities from being introduced through future ingestion mechanisms. The release also includes numerous non-security improvements, including new attribute types for x509 certificate fingerprints, UI warning fixes, API corrections for object editing, and enhancements to STIX 1 and STIX 2.0 import handling. Users running MISP instances are strongly urged to upgrade to 2.4.99 to remediate the vulnerability.

Mentioned in this report

Vulnerabilities CVE-2018-19908poc

Detection guidance

External Tool Execution from MISP with Unsanitized Input

ATT&CK T1059

Detects MISP spawning external utilities (tar, unzip, etc.) with arguments derived from user-supplied filenames without proper escaping. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: External Tool Execution from MISP with Unsanitized Input
description: Detects MISP processes invoking external utilities (archive extractors,
  XML processors) with filename arguments that may contain injection payloads. Targets
  the vulnerable pattern where uploaded STIX filenames are passed directly to command-line
  tools.
tags:
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_misp_context:
    ParentImage|contains:
    - misp
    - php-cgi
    - httpd
  selection_external_tools:
    Image|endswith:
    - \tar.exe
    - \unzip.exe
    - \7z.exe
    - \python.exe
    - \perl.exe
  selection_suspicious_args:
    CommandLine|contains:
    - .stix
    - .xml
    CommandLine|re: .*[\$`|;&><].*\.(?:stix|xml)
  condition: selection_misp_context and selection_external_tools and selection_suspicious_args
falsepositives:
- Legitimate MISP post-processing workflows extracting or parsing STIX archives
- Admin scripts intentionally using shell operators in import pipelines
level: medium
id: e35b73d4-1fcf-5e00-965e-714374c4194b
status: experimental
author: Vorant

MISP Process Spawning Interactive Shell with Filename Context

ATT&CK T1059

Detects MISP-related processes launching interactive shells (bash, cmd) where the command line references uploaded filenames or import operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: MISP Process Spawning Interactive Shell with Filename Context
description: Detects MISP or PHP processes invoking interactive command shells in
  the context of STIX/import operations with attacker-controlled filename references,
  suggesting command injection exploitation.
tags:
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_misp_shell:
    ParentImage|contains:
    - misp
    - php
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    CommandLine|contains:
    - '/c '
    - '/s '
    - -Command
  selection_import_context:
    CommandLine|contains:
    - stix
    - import
    - upload
  filter_legitimate:
    CommandLine|contains:
    - 'echo '
    - 'type '
  condition: selection_misp_shell and selection_import_context and not filter_legitimate
falsepositives:
- MISP debugging or logging commands that spawn shells for diagnostic output
level: medium
id: a405c410-fd9e-5661-affb-94c81dae1346
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.misp-project.org/2018/12/06/misp.2.4.99.released.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free