MISP 2.5.47 patches critical RCE and access-control flaws
MISP 2.5.47 closes 27 confirmed vulnerabilities including authenticated RCE, access-control bypasses, XSS, CSRF, and MFA bypass; update strongly recommended.
Sourcemisp-project.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
MISP 2.5.47 is a security-focused release addressing the outcome of an intensive external security review. Twenty-seven confirmed vulnerabilities were identified and fixed across multiple attack vectors: stored and reflected XSS in statistics, index and modal views; access-control bypasses in event reports, collections, sharing groups and distribution checks; CSRF exemptions on sensitive actions; a read-only API key that regained full account privileges; MFA and brute-force protection bypass via alternative HTTP verb on login; SSRF and local file read through XML parsing in MISP export uploads; path traversal in organisation logo handling; and most critically, unauthenticated remote code execution through background job argument handling accessible to any authenticated user. The release also introduced a new ledger-based database migration system replacing the legacy db_version counter, fresh PostgreSQL support as an alternative to MySQL/MariaDB, AI-assisted analysis integration for event summarisation and indicator extraction, and numerous Overmind interface improvements. Critical fixes include regression patches for background job stderr handling and CSRF validation introduced in 2.5.46.
Detection guidance
MISP Unauthenticated Remote Code Execution via Background Job Arguments
A behavioural hunt for the technique in general.
Detects exploitation of MISP background job argument handling RCE vulnerability through suspicious command execution or process spawning from MISP application context. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP Unauthenticated Remote Code Execution via Background Job Arguments
description: Detects exploitation of MISP CVE background job argument injection leading
to unauthenticated RCE. Monitors for unusual process creation or command execution
spawned from MISP application processes or web server contexts handling background
jobs.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_misp_process:
ParentImage|contains:
- misp
- php
- python
CommandLine|contains:
- /var/www/MISP
- /app/MISP
selection_suspicious_commands:
CommandLine|re: (bash|sh|curl|wget|nc|python|perl|ruby)\s+.*(-[irlce]|exec|system|eval)
selection_webserver_context:
ParentImage|contains:
- apache
- nginx
- php-fpm
User: www-data
condition: (selection_misp_process or selection_webserver_context) and selection_suspicious_commands
falsepositives:
- Legitimate MISP background job processing and scheduled tasks
- System administration scripts managing MISP installation
level: critical
id: a788d90a-2c43-5ebf-8210-b0fdf5a2237d
status: experimental
author: Vorant
references:
- https://www.misp-project.org/2026/09/17/misp.2.5.47.released.html
MISP SSRF and Local File Read via XML Export Upload
A behavioural hunt for the technique in general.
Detects SSRF and local file disclosure through malicious XML parsing in MISP export upload feature. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MISP SSRF and Local File Read via XML Export Upload
description: Detects exploitation of MISP XML parsing vulnerability in export upload
allowing SSRF and local file read. Monitors for XML processing from untrusted sources
with file or protocol handlers.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- php
- python
CommandLine|contains:
- xml
- export
- upload
selection_payload:
CommandLine|re: (file://|http://|https://|gopher://|ftp://|dict://)
filter_legitimate:
CommandLine|contains:
- MISP_EXPECTED_EXPORT
condition: selection and selection_payload and not filter_legitimate
falsepositives:
- Legitimate MISP export/import operations with XML content
- Security scanning tools testing MISP functionality
level: high
id: 769f6e1a-3d26-584b-8388-df64eae53256
status: experimental
author: Vorant
references:
- https://www.misp-project.org/2026/09/17/misp.2.5.47.released.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.misp-project.org/2026/09/17/misp.2.5.47.released.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs