# MISP 2.4.158 patches critical RCE and multiple XSS flaws

Published: 2022-04-20 · Severity: routine · Sectors: government-national, defense
Canonical: https://vorant.io/reports/fe40b39c-5617-52a3-841b-b5c6d5ca5b4b/misp-2-4-158-patches-critical-rce-and-multiple-xss-flaws

> MISP releases security update fixing phar deserialization RCE and six XSS vulnerabilities; immediate patching required.

MISP v2.4.158 addresses multiple security vulnerabilities discovered during a penetration test by Zigrin Security. Most significantly, a critical phar deserialization remote code execution flaw was silently patched in v2.4.156 and is now publicly disclosed; instances below v2.4.156 require immediate updating. The v2.4.158 release additionally fixes six cross-site scripting (XSS) vulnerabilities affecting LinOTP login, Galaxy clusters, organisation fetchSGOrgRow, Event graph tags, and Cerebrate views, along with a password confirmation bypass. While most vulnerabilities require a compromised high-privilege account to exploit, the critical RCE vulnerability represents a higher-severity threat vector. The project recommends all users update to v2.4.158 immediately, emphasizing that any instance running below v2.4.156 is at elevated risk.

## Mentioned in this report

- Vulnerabilities: CVE-2022-24725

## Detection guidance (public sample)

### Web Server or PHP-FPM Process Spawning a Shell on Linux

ATT&CK: T1190

Apache, nginx or PHP-FPM spawning an interactive shell or interpreter, a typical post-exploitation pattern after RCE (e.g. phar deserialization in MISP) in a public-facing PHP app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP-FPM Process Spawning a Shell on Linux
description: Detects Apache, nginx or PHP-FPM worker processes spawning a shell or
  scripting interpreter. This is the typical result of successful remote code execution
  in a PHP web application such as MISP, for example via phar deserialization. Generalises
  on the parent/child relation, not on any exploit payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - apache2
    - httpd
    - php-fpm
    - nginx
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /python
    - /python3
    - /perl
    - /nc
    - /ncat
  filter_mail:
    CommandLine|contains: sendmail
  condition: selection and not filter_mail
falsepositives:
- PHP applications that legitimately call exec/system for helper scripts through a
  shell
- Apache CGI scripts written in shell, perl or python
level: high
id: a4451570-6224-5919-90df-bd1a1f3bafea
status: experimental
author: Vorant
references:
- https://www.misp-project.org/2022/04/20/misp.2.4.158.released.html
```

### phar Stream Wrapper in Web Request Targeting PHP Application

ATT&CK: T1190

Web request whose query string references the phar:// wrapper, a common vector for PHP phar deserialization RCE such as the MISP flaw fixed in 2.4.156. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: phar Stream Wrapper in Web Request Targeting PHP Application
description: Detects web requests whose query string contains the phar:// stream wrapper
  (plain or URL-encoded). This is a known vector for PHP phar deserialization RCE,
  such as the MISP flaw fixed in v2.4.156. Tune by restricting to MISP hosts.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - phar://
    - phar%3a%2f%2f
    - phar%3A%2F%2F
  condition: selection
falsepositives:
- Vulnerability scanners run by the security team against the application
- Developer tooling that legitimately passes phar paths as parameters
level: medium
id: ca5f010f-4c87-5ea6-b3e9-9eec5212972c
status: experimental
author: Vorant
references:
- https://www.misp-project.org/2022/04/20/misp.2.4.158.released.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.misp-project.org/2022/04/20/misp.2.4.158.released.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fe40b39c-5617-52a3-841b-b5c6d5ca5b4b/misp-2-4-158-patches-critical-rce-and-multiple-xss-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup