MISP 2.5.37 patches SQL injection, privesc bugs
MISP 2.5.37 ships a new Event Templating system and fixes three vulnerabilities, including a blind SQL injection and an auth-key privilege escalation to site admin.
The MISP project released version 2.5.37, primarily notable for a ground-up rewrite of its event templating engine, a new dedicated `suricata` attribute type, continued UI migration to the Overmind (Bootstrap 5) theme, and a switch to the upstream STIX 2 library. Alongside these feature changes, the release addresses three security issues that were responsibly disclosed and assigned GCVE identifiers.
The most significant fix addresses a blind SQL injection vulnerability where user-controlled `order`/`sort` parameters on `POST /events/index` and `GET /shadow_attributes/index` reached the SQL `ORDER BY` clause without validation, allowing any authenticated user — including read-only accounts — to extract arbitrary database content. A second issue allowed an organisation admin sharing an org with a site admin to reset that site admin's authentication key via `POST /users/resetauthkey/<id>` and retrieve the new key in the response, enabling privilege escalation to full site-admin access. A third, lower-severity fix enforces RFC 4122 validation on Collection UUIDs. All three were reported by external researchers (Jeroen Gui and Jeroen Pinoy) and are fixed in this release with no indication of in-the-wild exploitation.
Given MISP's broad deployment across threat intelligence teams, CERTs, and information-sharing communities, administrators should prioritize upgrading to 2.5.37, particularly to close the privilege-escalation and SQL injection paths, both of which are exploitable by any authenticated, low-privileged user.
Detection guidance
MISP SQL Injection via Order Parameter
Detects POST requests to /events/index or GET requests to /shadow_attributes/index with suspicious ORDER BY payloads in order/sort parameters—blind SQL injection exploitation pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP SQL Injection via Order Parameter
description: Detects attempts to exploit blind SQL injection in MISP's order/sort
parameters on events/index and shadow_attributes/index endpoints. Targets POST /events/index
and GET /shadow_attributes/index with SQL keywords or comment syntax in order/sort
query strings.
tags:
- attack.t1190
logsource:
category: web_application
product: misp
detection:
selection_post_events:
http_method: POST
url|contains: /events/index
query_string|contains|all:
- order
- ''''
selection_get_shadow:
http_method: GET
url|contains: /shadow_attributes/index
query_string|contains|all:
- sort
- ''''
selection_sql_keywords:
query_string|contains:
- UNION
- CAST(
- 'CASE '
- --
- /*
- SLEEP(
- BENCHMARK(
condition: (selection_post_events or selection_get_shadow) and selection_sql_keywords
falsepositives:
- Legitimate administrative tools escaping quotes in sort fields
level: high
id: 4eb79352-0451-5276-a7a1-b6f1bf59ce97
status: experimental
author: Vorant
MISP Privilege Escalation via Auth Key Reset
Detects POST requests to /users/resetauthkey/ endpoint where a non-admin user resets a higher-privileged account's authentication key—privilege escalation exploitation pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP Privilege Escalation via Auth Key Reset
description: Detects POST requests to /users/resetauthkey/<id> endpoint exploited
by org-admin accounts to reset site-admin authentication keys and extract the new
key in the response, enabling privilege escalation.
tags:
- attack.t1078
logsource:
category: web_application
product: misp
detection:
selection:
http_method: POST
url|contains: /users/resetauthkey/
http_response_status: 200
filter_site_admin:
user_role: site_admin
condition: selection and not filter_site_admin
falsepositives:
- Legitimate site administrators resetting their own or other admin authentication
keys
level: high
id: 110b2f0b-9279-5fa4-8866-766e88ba1092
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.misp-project.org/2026/04/29/misp.2.5.37.released.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free