Multiple vulnerabilities in MISP threat platform
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Six vulnerabilities in MISP before version 2.5.37 allow privilege escalation, SQL injection, and security policy bypass.
CERT-FR advisory documents multiple critical vulnerabilities affecting MISP, a widely-used open-source threat intelligence platform. The affected versions are all releases prior to 2.5.37. The vulnerabilities enable attackers to escalate privileges within the platform, execute arbitrary SQL queries through injection attacks, and bypass security policies that govern access control. Organizations operating MISP for threat data collection, analysis, and sharing must update immediately to version 2.5.37 or later to remediate these issues. The advisory references the vendor's own security bulletin dated 30 April 2026 for patching and remediation details.
Mentioned in this report
Detection guidance
SQL Injection Patterns in Requests to MISP Application Paths
Detects SQL injection keywords and functions in the query string of web requests to common MISP endpoints, which could indicate exploitation of the MISP SQLi flaws fixed in 2.5.37. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Patterns in Requests to MISP Application Paths
description: Detects SQL injection syntax (UNION SELECT, time-based and error-based
functions, information_schema access) in the URI query of requests to typical MISP
controller paths. Targets MISP releases before 2.5.37. Path matching is generic
to MISP routing and not tied to a specific exploit artefact. Tune the paths to your
deployment.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /events/
- /attributes/
- /objects/
- /users/
- /organisations/
- /servers/
- /sightings/
- /galaxies/
- /tags/
- /taxonomies/
- /warninglists/
selection_sqli:
cs-uri-query|contains:
- union select
- union%20select
- union+select
- union all select
- information_schema
- sleep(
- sleep%28
- benchmark(
- extractvalue(
- updatexml(
- waitfor delay
- waitfor%20delay
- ''' or ''1''=''1'
- '%27%20or%20%271%27%3D%271'
condition: selection_path and selection_sqli
falsepositives:
- Authorised vulnerability scanners or penetration tests against the MISP instance
- Legitimate MISP searches whose free-text value contains SQL keywords, such as threat
reports quoting SQLi payloads
level: medium
id: ae026b56-9726-553d-bdf7-b6533d10185d
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0515
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0515
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs