MISP 2.5.43 patches RCE and access-control flaws
MISP 2.5.43 closes two remote-code-execution vulnerabilities, authentication issues, and mass-assignment/broken-access-control flaws across 74 controllers; upgrade is strongly recommended.
MISP released version 2.5.43 as a security hardening release addressing multiple critical authorization and code-execution issues. A structured codebase-wide audit of 74 controllers uncovered two RCE vectors: one via arbitrary rdkafka config-path manipulation and another via arbitrary ndjson log-path control, both previously mitigated only by requiring a compromised site-admin account. The release also remediates seven broken-access-control (IDOR) issues across EventReports, SharingGroups, CollectionElements, TemplateElements, and the DecayingModel subsystem, plus 13 mass-assignment fixes preventing unauthorized field modification. Azure AD authentication was hardened and crypto-key restrictions tightened to supported Event parent types.
Mentioned in this report
Detection guidance
MISP RCE via Arbitrary rdkafka Configuration Path
Detects exploitation attempts targeting MISP's rdkafka config-path vulnerability through HTTP requests containing rdkafka configuration directives or path traversal in config parameters. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP RCE via Arbitrary rdkafka Configuration Path
description: Detects HTTP requests to MISP instances attempting to exploit rdkafka
arbitrary configuration-path vulnerability. Targets requests with rdkafka-related
parameters or path traversal patterns in configuration arguments.
tags:
- attack.t1190
logsource:
category: proxy
product: http
detection:
selection:
url|contains:
- rdkafka
- brokers
http_request_method: POST
selection_path_traversal:
url|contains:
- ..
- ../
filter_legitimate:
user_agent|contains:
- monitoring
- healthcheck
condition: (selection or selection_path_traversal) and not filter_legitimate
falsepositives:
- Legitimate MISP Kafka broker configuration management by administrators
- Monitoring/health-check scripts probing broker connectivity
level: high
id: b0220c63-c016-543c-915b-faba9a401a89
status: experimental
author: Vorant
MISP RCE via Arbitrary ndjson Log-Path Manipulation
Detects exploitation attempts targeting MISP's arbitrary ndjson log-path vulnerability through HTTP requests containing path traversal or suspicious log file path parameters. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP RCE via Arbitrary ndjson Log-Path Manipulation
description: Detects HTTP requests to MISP instances attempting to exploit ndjson
arbitrary log-path vulnerability. Targets requests with path traversal patterns
or suspicious log-file path manipulation in request parameters.
tags:
- attack.t1190
logsource:
category: proxy
product: http
detection:
selection_ndjson:
url|contains: ndjson
selection_path_control:
url|contains:
- log
- path
- file
selection_traversal:
url|contains:
- ..
- ../
- ..\\
filter_admin:
user_agent|contains:
- MISP
- admin
condition: (selection_ndjson and (selection_path_control or selection_traversal))
and not filter_admin
falsepositives:
- MISP administrative log retrieval and configuration by authorized operators
- Legitimate audit log exports via MISP API
level: high
id: 7779eb16-aec1-5cce-9a56-88d7ee1364c7
status: experimental
author: Vorant
MISP Broken Access Control - Unauthorized Resource Access via IDOR
Detects HTTP requests attempting to access MISP resources (EventReports, SharingGroups, CollectionElements, TemplateElements, DecayingModel) with sequential or enumerated IDs suggesting IDOR exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP Broken Access Control - Unauthorized Resource Access via IDOR
description: Detects HTTP GET/POST requests to MISP API endpoints for EventReports,
SharingGroups, CollectionElements, TemplateElements, or DecayingModel that use sequential
or enumerated ID parameters, indicating potential IDOR abuse.
tags:
- attack.t1078
logsource:
category: proxy
product: http
detection:
selection_endpoints:
url|contains:
- EventReports
- SharingGroups
- CollectionElements
- TemplateElements
- DecayingModel
selection_method:
http_request_method:
- GET
- POST
selection_id_param:
url|re: (id|eventid|groupid|elementid)=\d{1,5}
filter_admin:
user_agent|contains:
- monitoring
- internal
condition: (selection_endpoints and selection_method and selection_id_param) and
not filter_admin
falsepositives:
- Legitimate MISP users accessing their own shared events and resources with sequential
IDs
- MISP administrative dashboards and bulk export operations
level: medium
id: ee748310-7463-5716-ad4a-0ea28fa910a5
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.misp-project.org/2026/06/22/misp.2.5.43.released.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free