CVE-2022-29528
📋 TL;DR
CVE-2022-29528 is a PHAR deserialization vulnerability in MISP (Malware Information Sharing Platform) that allows attackers to execute arbitrary code on affected systems. This affects all MISP instances running versions before 2.4.158. The vulnerability stems from improper handling of PHAR archives that can trigger deserialization of untrusted data.
💻 Affected Systems
- MISP (Malware Information Sharing Platform)
📦 What is this software?
Misp by Misp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to gain shell access, install malware, or manipulate MISP data.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires file upload capability or ability to control PHAR archive paths. The vulnerability is in the CakePHP framework used by MISP.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.158
Vendor Advisory: https://github.com/MISP/MISP/commit/0108f1bde2117ac5c1e28d124128f60c8bb09a8e
Restart Required: No
Instructions:
1. Backup your MISP instance and database. 2. Update to MISP version 2.4.158 or later. 3. Verify the update by checking the version in the web interface or via command line.
🔧 Temporary Workarounds
Disable PHAR support in PHP
allDisable PHAR extension to prevent deserialization attacks
php -d phar.readonly=1 -d phar.require_hash=1
Edit php.ini: phar.readonly = On
Edit php.ini: phar.require_hash = On
Restrict file uploads
allLimit file upload capabilities to trusted users only
🧯 If You Can't Patch
- Implement strict network access controls to limit MISP access to trusted IPs only
- Deploy web application firewall (WAF) with rules to detect and block PHAR deserialization attempts
🔍 How to Verify
Check if Vulnerable:
Check MISP version via web interface (Admin -> Server Settings -> Diagnostics) or command line: grep 'appversion' /var/www/MISP/app/Config/config.phpCheck Version:
grep "'appversion'" /var/www/MISP/app/Config/config.php | cut -d"'" -f4Verify Fix Applied:
Verify version is 2.4.158 or higher and check that the commits 0108f1bde2117ac5c1e28d124128f60c8bb09a8e and 93821c0de6a7dd32262ce62212773f43136ca66e are present📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with .phar extensions
- PHP errors related to unserialize() or phar:// streams
- Unexpected process execution from web user context
Network Indicators:
- HTTP requests containing phar:// in parameters
- File uploads to MISP endpoints with suspicious content
SIEM Query:
source="misp_logs" AND (phar OR unserialize OR "remote code execution")🔗 References
- https://github.com/MISP/MISP/commit/0108f1bde2117ac5c1e28d124128f60c8bb09a8e
- https://github.com/MISP/MISP/commit/93821c0de6a7dd32262ce62212773f43136ca66e
- https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158
- https://zigrin.com/advisories/misp-phar-deserialization/
- https://zigrin.com/cakephp-application-cybersecurity-research-exploring-the-phar-deserialization-php-vulnerability-a-white-box-testing-example/
- https://github.com/MISP/MISP/commit/0108f1bde2117ac5c1e28d124128f60c8bb09a8e
- https://github.com/MISP/MISP/commit/93821c0de6a7dd32262ce62212773f43136ca66e
- https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158
- https://zigrin.com/advisories/misp-phar-deserialization/
- https://zigrin.com/cakephp-application-cybersecurity-research-exploring-the-phar-deserialization-php-vulnerability-a-white-box-testing-example/
