MISP 2.4.121 patches five security flaws
MISP 2.4.121 fixes an XSS bug, an ACL flaw, and brute-force protection bypasses reported by Dawid Czarnecki.
The MISP threat-intelligence platform released version 2.4.121 to address five vulnerabilities discovered by researcher Dawid Czarnecki. The issues include a reflected XSS in the galaxy view (CVE-2020-8893), an ACL enforcement gap on discussion threads (CVE-2020-8894), and multiple weaknesses in brute-force protection stemming from time skew between web and database servers (CVE-2020-8890), missing username canonicalisation (CVE-2020-8891), and PUT requests bypassing login protection (CVE-2020-8892).
While the MISP project characterizes these issues as non-critical, they collectively weaken account protections and could allow attackers to bypass brute-force lockouts or execute script injection in the UI. Administrators are urged to update promptly. The release also includes unrelated functional improvements such as sync pull filters, background worker configuration reloading, memory handling improvements, and new object templates.
Mentioned in this report
Detection guidance
Potential MISP Brute-Force Login Bypass via Repeated Auth Requests
Detects repeated POST requests to the MISP login endpoint that may indicate brute-force attempts exploiting the CVE-2020-8890/8891 time-skew or username canonicalisation weaknesses; review the underlying log source for volume/frequency over a short window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential MISP Brute-Force Login Bypass via Repeated Auth Requests
id: a74becaf-63ee-51a3-8902-c4c2a4ffd253
status: experimental
description: Detects POST requests to the MISP /users/login endpoint returning failed
authentication responses, which combined with high frequency may indicate brute-force
attempts exploiting known MISP lockout weaknesses (CVE-2020-8890/8891). Analysts
should correlate volume of these events per source IP/user over a short time window,
as this rule only flags the individual request pattern.
references:
- MISP 2.4.121 changelog
author: Vorant
tags:
- attack.t1110
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /users/login
sc-status:
- '401'
- '403'
condition: selection
falsepositives:
- Users mistyping passwords during normal login
- Automated SSO/password-manager retry mechanisms
level: medium
MISP PUT Request to Sensitive Endpoint Bypassing Login Protection
Detects PUT method requests to MISP core data endpoints (events/objects/attributes) which historically could bypass authentication/login checks (CVE-2020-8892). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP PUT Request to Sensitive Endpoint Bypassing Login Protection
id: 4ca2a76b-4098-5d37-a3b5-9deec52eb96d
status: experimental
description: Detects HTTP PUT requests targeting MISP's core data-modifying endpoints
(events, objects, attributes). Prior MISP versions allowed PUT requests to bypass
login protection (CVE-2020-8892), so PUT traffic to these paths without an authenticated
session or API key context is suspicious.
references:
- MISP 2.4.121 changelog
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method: PUT
cs-uri-stem|contains:
- /events/
- /objects/
- /attributes/
filter:
cs-uri-query|contains: api_key=
condition: selection and not filter
falsepositives:
- Legitimate automated sync or feed pull jobs using PUT with valid API keys not captured
in query string
- Internal integration scripts updating MISP objects via authenticated API calls
level: high
Reflected XSS Attempt in MISP Galaxy View Parameter
Detects script-injection patterns in the query string of MISP's galaxy view endpoint, consistent with the reflected XSS weakness fixed in CVE-2020-8893. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt in MISP Galaxy View Parameter
id: 970ca5bb-80d8-5b68-9eaf-7236a03f7a72
status: experimental
description: Detects requests to the MISP galaxy view page containing script-injection
patterns (e.g. <script>, javascript:, onerror=) in the query string, indicative
of exploitation attempts against the reflected XSS vulnerability CVE-2020-8893.
references:
- MISP 2.4.121 changelog
author: Vorant
tags:
- attack.t1059.007
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /galaxies/view
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
condition: selection
falsepositives:
- Security scanners or vulnerability assessment tools testing the same endpoint
- Automated QA/regression tests submitting crafted payloads for validation
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.misp-project.org/2020/02/12/misp.2.4.121.released.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free