CVE-2023-28884
📋 TL;DR
This vulnerability allows cross-site scripting (XSS) attacks in MISP's community index page. Attackers can inject malicious scripts that execute in victims' browsers when viewing the community index. All MISP instances running version 2.4.169 are affected.
💻 Affected Systems
- MISP (Malware Information Sharing Platform)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially compromising the entire MISP instance and sensitive threat intelligence data.
Likely Case
Session hijacking leading to unauthorized access to threat intelligence data, manipulation of MISP data, or credential theft from authenticated users.
If Mitigated
Limited impact due to same-origin policy restrictions, but still allows attacker-controlled content execution in victim browsers.
🎯 Exploit Status
Exploitation requires user interaction (viewing the community index) but XSS payloads are simple to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.170 and later
Vendor Advisory: https://github.com/MISP/MISP/commit/b94c7978e5e6b1db369abeedbbf00bca975b08b7
Restart Required: No
Instructions:
1. Update MISP to version 2.4.170 or later. 2. Apply the patch from the GitHub commit. 3. Clear browser caches and verify the fix.
🔧 Temporary Workarounds
Input Sanitization
allImplement additional input validation and output encoding for community index parameters
Modify app/Lib/Tools/CustomPaginationTool.php to sanitize user input
🧯 If You Can't Patch
- Restrict access to the community index page using web application firewall rules
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if MISP version is 2.4.169 by visiting the about page or checking the version fileCheck Version:
cat /var/www/MISP/VERSION.json | grep versionVerify Fix Applied:
Verify version is 2.4.170+ and test community index page with XSS payloads📡 Detection & Monitoring
Log Indicators:
- Unusual parameters in community index requests
- JavaScript payloads in URL parameters
Network Indicators:
- Suspicious script tags in HTTP requests to community index
SIEM Query:
web_access_logs WHERE url LIKE '%/events/index/community%' AND (params CONTAINS '<script' OR params CONTAINS 'javascript:')