# MISP 2.4.110 fixes admin RCE flaw

Published: 2019-07-08 · Severity: medium
Canonical: https://vorant.io/reports/759cfad0-a6bc-5085-9009-9783143a66bf/misp-2-4-110-fixes-admin-rce-flaw

> MISP 2.4.110 patches a site-admin-triggered remote code execution vulnerability (CVE-2019-12868) via PHP deserialization, alongside new features.

The MISP project released version 2.4.110, addressing CVE-2019-12868, a remote command execution vulnerability present in MISP 2.4.109. The flaw stems from the PHP file_exists function being called with user-controlled input, where phar:// URLs trigger unsafe deserialization. Exploitation requires site administrator privileges, limiting the practical attack surface to malicious or compromised admin accounts rather than unauthenticated attackers.

Beyond the security fix, the release introduces several feature improvements including expanded misp-modules support for the full MISP standard format, local tagging capabilities for in-place tagging without violating MISP's ownership model, a new Norwegian translation, and various STIX 2.0 parsing fixes. The security-relevant change also restricts certain risky settings to CLI-only access, reducing exposure even for site admins.

This is a routine software maintenance advisory; the vulnerability was responsibly disclosed by researcher Dawid Czarnecki and patched promptly, with no indication of active exploitation in the wild.

## Mentioned in this report

- Vulnerabilities: CVE-2019-12868

## Detection guidance (public sample)

### Potential PHP phar:// Deserialization Exploit Attempt via Web Request

ATT&CK: T1190

Detects HTTP requests containing phar:// URL wrapper references in query strings or parameters, a pattern used to trigger unsafe PHP deserialization such as the MISP 2.4.109 file_exists RCE (CVE-2019-12868). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential PHP phar:// Deserialization Exploit Attempt via Web Request
id: a48305bc-40b7-596a-9792-8e0c0f66d1b8
status: experimental
description: 'Detects web requests containing the phar:// stream wrapper in the URI,
  query string, or POST body.

  This pattern is used to trigger unsafe deserialization in PHP applications that
  call file-check

  functions (e.g. file_exists) on user-controlled input, as seen in the MISP 2.4.109
  admin RCE

  (CVE-2019-12868). Legitimate application traffic rarely includes phar:// references
  in HTTP

  parameters.

  '
references:
- https://www.circl.lu/doc/misp/changelog/
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: phar://
  selection_stem:
    cs-uri-stem|contains: phar://
  selection_body:
    cs-method: POST
  filter:
    cs-uri-query|contains:
    - phar://example
  condition: (selection or selection_stem) and not filter
falsepositives:
- Internal tooling or scanners that legitimately reference phar archives for packaging
  or testing
- Security scanning/pentest traffic intentionally probing for this vulnerability class
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.misp-project.org/2019/07/08/misp.2.4.110.released.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/759cfad0-a6bc-5085-9009-9783143a66bf/misp-2-4-110-fixes-admin-rce-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup