CVE-2023-37306
📋 TL;DR
CVE-2023-37306 is an information disclosure vulnerability in MISP (Malware Information Sharing Platform) where improper handling of certificate file extensions during server synchronization leaks sensitive information through error messages. Attackers can exploit this to read arbitrary files from the server. Organizations running vulnerable MISP instances are affected.
💻 Affected Systems
- MISP (Malware Information Sharing Platform)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers can read sensitive server files including configuration files, private keys, and database credentials, potentially leading to full system compromise.
Likely Case
Attackers extract configuration files containing API keys, database credentials, or other sensitive operational data.
If Mitigated
With proper network segmentation and access controls, impact is limited to the MISP application server only.
🎯 Exploit Status
Exploitation requires the ability to trigger server sync operations. The vulnerability leverages PHP filter chains to read files through error messages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.173 and later
Vendor Advisory: https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
Restart Required: No
Instructions:
1. Update MISP to version 2.4.173 or later. 2. Run the update script: cd /var/www/MISP && git pull. 3. Update dependencies: cd /var/www/MISP/app && php composer.phar update. 4. Clear caches if necessary.
🔧 Temporary Workarounds
Disable Server Synchronization
allTemporarily disable MISP server synchronization features to prevent exploitation.
Edit MISP configuration to disable sync features or restrict sync permissions
Restrict Certificate Uploads
allImplement strict validation on certificate file uploads and extensions.
Configure web server to reject unexpected file extensions in sync requests
🧯 If You Can't Patch
- Implement strict network access controls to limit who can initiate server sync operations
- Monitor and alert on unusual file read attempts through MISP sync logs
🔍 How to Verify
Check if Vulnerable:
Check MISP version: grep -i version /var/www/MISP/VERSION.json or via web interface. If version is 2.4.172 or earlier, system is vulnerable.Check Version:
cat /var/www/MISP/VERSION.json | grep versionVerify Fix Applied:
Verify version is 2.4.173 or later and test that certificate validation properly rejects invalid file extensions.📡 Detection & Monitoring
Log Indicators:
- Error messages containing file paths in MISP logs
- Unusual certificate validation failures in sync logs
- Multiple failed sync attempts with unusual file extensions
Network Indicators:
- Unusual outbound file transfers from MISP server
- Suspicious sync requests to/from unauthorized IPs
SIEM Query:
source="misp.log" AND ("certificate" OR "sync") AND ("error" OR "failed") AND ("file" OR "path")🔗 References
- https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
- https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle
- https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
- https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle
