CVE-2022-48328
📋 TL;DR
This vulnerability in MISP (Malware Information Sharing Platform) allows SQL injection through mishandled URL parameters in the IndexFilterComponent. Attackers can exploit this to execute arbitrary SQL commands on the database. All MISP instances running vulnerable versions are affected.
💻 Affected Systems
- MISP (Malware Information Sharing Platform)
📦 What is this software?
Misp by Misp
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, or data exfiltration from the MISP database.
If Mitigated
Limited impact if database permissions are properly restricted and input validation is enforced elsewhere.
🎯 Exploit Status
Exploitation requires authenticated access to MISP. The vulnerability is in a core component used for filtering/searching.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.167 and later
Vendor Advisory: https://github.com/MISP/MISP/commit/1edbc2569989f844799261a5f90edfa433d7dbcc
Restart Required: No
Instructions:
1. Backup your MISP instance and database. 2. Update MISP to version 2.4.167 or later using git: 'git pull origin 2.4'. 3. Run the update script: 'sudo -u www-data bash /var/www/MISP/app/Console/cake Admin runUpdates'. 4. Clear caches if necessary.
🔧 Temporary Workarounds
Input Validation Filter
allImplement additional input validation for URL parameters in application code
Not applicable - requires code modification
Database Permission Restriction
linuxLimit database user permissions to minimum required operations
ALTER USER 'misp_user'@'localhost' WITH GRANT OPTION;
REVOKE DROP, CREATE, ALTER ON misp.* FROM 'misp_user'@'localhost';
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns in URL parameters
- Restrict access to MISP interface to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check MISP version: 'cd /var/www/MISP && git describe --tags' or check web interface version. If version is earlier than 2.4.167, you are vulnerable.Check Version:
cd /var/www/MISP && git describe --tags || grep 'appversion' /var/www/MISP/app/Config/config.phpVerify Fix Applied:
Verify version is 2.4.167 or later and check that the IndexFilterComponent.php file contains the security fixes from the referenced commits.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by complex URL parameter requests
- Requests with unusual characters in URL parameters (semicolons, quotes, SQL keywords)
Network Indicators:
- HTTP requests with SQL keywords in URL parameters
- Unusual parameter names in GET requests to MISP endpoints
SIEM Query:
source="misp_access.log" AND (url="*SELECT*" OR url="*UNION*" OR url="*INSERT*" OR url="*DELETE*" OR url="*UPDATE*")🔗 References
- https://github.com/MISP/MISP/commit/1edbc2569989f844799261a5f90edfa433d7dbcc
- https://github.com/MISP/MISP/commit/206f540f0275af2dd2a86275abc199df41e72a21
- https://github.com/MISP/MISP/compare/v2.4.166...v2.4.167
- https://zigrin.com/advisories/misp-sql-injection-in-crud-component/
- https://zigrin.com/cakephp-application-cybersecurity-research-hiding-in-plain-sight-the-hidden-danger-of-sql-injection-in-input-field-names/
- https://github.com/MISP/MISP/commit/1edbc2569989f844799261a5f90edfa433d7dbcc
- https://github.com/MISP/MISP/commit/206f540f0275af2dd2a86275abc199df41e72a21
- https://github.com/MISP/MISP/compare/v2.4.166...v2.4.167
- https://zigrin.com/advisories/misp-sql-injection-in-crud-component/
- https://zigrin.com/cakephp-application-cybersecurity-research-hiding-in-plain-sight-the-hidden-danger-of-sql-injection-in-input-field-names/
