MISP 2.4.110 fixes admin RCE flaw
MISP 2.4.110 patches a site-admin-triggered remote code execution vulnerability (CVE-2019-12868) via PHP deserialization, alongside new features.
The MISP project released version 2.4.110, addressing CVE-2019-12868, a remote command execution vulnerability present in MISP 2.4.109. The flaw stems from the PHP file_exists function being called with user-controlled input, where phar:// URLs trigger unsafe deserialization. Exploitation requires site administrator privileges, limiting the practical attack surface to malicious or compromised admin accounts rather than unauthenticated attackers.
Beyond the security fix, the release introduces several feature improvements including expanded misp-modules support for the full MISP standard format, local tagging capabilities for in-place tagging without violating MISP's ownership model, a new Norwegian translation, and various STIX 2.0 parsing fixes. The security-relevant change also restricts certain risky settings to CLI-only access, reducing exposure even for site admins.
This is a routine software maintenance advisory; the vulnerability was responsibly disclosed by researcher Dawid Czarnecki and patched promptly, with no indication of active exploitation in the wild.
Mentioned in this report
Detection guidance
Potential PHP phar:// Deserialization Exploit Attempt via Web Request
Detects HTTP requests containing phar:// URL wrapper references in query strings or parameters, a pattern used to trigger unsafe PHP deserialization such as the MISP 2.4.109 file_exists RCE (CVE-2019-12868). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential PHP phar:// Deserialization Exploit Attempt via Web Request
id: a48305bc-40b7-596a-9792-8e0c0f66d1b8
status: experimental
description: 'Detects web requests containing the phar:// stream wrapper in the URI,
query string, or POST body.
This pattern is used to trigger unsafe deserialization in PHP applications that
call file-check
functions (e.g. file_exists) on user-controlled input, as seen in the MISP 2.4.109
admin RCE
(CVE-2019-12868). Legitimate application traffic rarely includes phar:// references
in HTTP
parameters.
'
references:
- https://www.circl.lu/doc/misp/changelog/
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: phar://
selection_stem:
cs-uri-stem|contains: phar://
selection_body:
cs-method: POST
filter:
cs-uri-query|contains:
- phar://example
condition: (selection or selection_stem) and not filter
falsepositives:
- Internal tooling or scanners that legitimately reference phar archives for packaging
or testing
- Security scanning/pentest traffic intentionally probing for this vulnerability class
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.misp-project.org/2019/07/08/misp.2.4.110.released.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free