MISP 2.4.158 patches critical RCE and multiple XSS flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
MISP releases security update fixing phar deserialization RCE and six XSS vulnerabilities; immediate patching required.
MISP v2.4.158 addresses multiple security vulnerabilities discovered during a penetration test by Zigrin Security. Most significantly, a critical phar deserialization remote code execution flaw was silently patched in v2.4.156 and is now publicly disclosed; instances below v2.4.156 require immediate updating. The v2.4.158 release additionally fixes six cross-site scripting (XSS) vulnerabilities affecting LinOTP login, Galaxy clusters, organisation fetchSGOrgRow, Event graph tags, and Cerebrate views, along with a password confirmation bypass. While most vulnerabilities require a compromised high-privilege account to exploit, the critical RCE vulnerability represents a higher-severity threat vector. The project recommends all users update to v2.4.158 immediately, emphasizing that any instance running below v2.4.156 is at elevated risk.
Mentioned in this report
Detection guidance
Web Server or PHP-FPM Process Spawning a Shell on Linux
Apache, nginx or PHP-FPM spawning an interactive shell or interpreter, a typical post-exploitation pattern after RCE (e.g. phar deserialization in MISP) in a public-facing PHP app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or PHP-FPM Process Spawning a Shell on Linux
description: Detects Apache, nginx or PHP-FPM worker processes spawning a shell or
scripting interpreter. This is the typical result of successful remote code execution
in a PHP web application such as MISP, for example via phar deserialization. Generalises
on the parent/child relation, not on any exploit payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- apache2
- httpd
- php-fpm
- nginx
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /python
- /python3
- /perl
- /nc
- /ncat
filter_mail:
CommandLine|contains: sendmail
condition: selection and not filter_mail
falsepositives:
- PHP applications that legitimately call exec/system for helper scripts through a
shell
- Apache CGI scripts written in shell, perl or python
level: high
id: a4451570-6224-5919-90df-bd1a1f3bafea
status: experimental
author: Vorant
references:
- https://www.misp-project.org/2022/04/20/misp.2.4.158.released.html
phar Stream Wrapper in Web Request Targeting PHP Application
Web request whose query string references the phar:// wrapper, a common vector for PHP phar deserialization RCE such as the MISP flaw fixed in 2.4.156. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: phar Stream Wrapper in Web Request Targeting PHP Application
description: Detects web requests whose query string contains the phar:// stream wrapper
(plain or URL-encoded). This is a known vector for PHP phar deserialization RCE,
such as the MISP flaw fixed in v2.4.156. Tune by restricting to MISP hosts.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- phar://
- phar%3a%2f%2f
- phar%3A%2F%2F
condition: selection
falsepositives:
- Vulnerability scanners run by the security team against the application
- Developer tooling that legitimately passes phar paths as parameters
level: medium
id: ca5f010f-4c87-5ea6-b3e9-9eec5212972c
status: experimental
author: Vorant
references:
- https://www.misp-project.org/2022/04/20/misp.2.4.158.released.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.misp-project.org/2022/04/20/misp.2.4.158.released.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs