CVE-2023-48655 – This vulnerability in MISP (Malware Information... (How to Fix)

Q: What is the severity of CVE-2023-48655?

CVE-2023-48655 has a CVSS score of 9.8 (CRITICAL). This vulnerability in MISP (Malware Information Sharing Platform) allows blind SQL injection through improperly filtered array input parameters. Attackers can exploit this to execute arbitrary SQL queries, potentially leading to data theft, manipulation, or system compromise. All MISP instances running vulnerable versions are affected.

📋 TL;DR

This vulnerability in MISP (Malware Information Sharing Platform) allows blind SQL injection through improperly filtered array input parameters. Attackers can exploit this to execute arbitrary SQL queries, potentially leading to data theft, manipulation, or system compromise. All MISP instances running vulnerable versions are affected.

💻 Affected Systems

Products:

MISP (Malware Information Sharing Platform)

Versions: All versions before 2.4.176

Operating Systems: All platforms running MISP

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all MISP deployments regardless of configuration; vulnerability exists in core IndexFilterComponent.

📦 What is this software?

Malware Information Sharing Platform by Misp Project

View all CVEs affecting Malware Information Sharing Platform →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise allowing data exfiltration, modification, or deletion; potential remote code execution through database functions; full system takeover.

🟠

Likely Case

Unauthorized access to sensitive threat intelligence data, user credentials, or system information; data manipulation affecting MISP operations.

🟢

If Mitigated

Limited impact due to proper input validation, parameterized queries, and database permissions restricting damage to non-critical data.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires authenticated access; SQL injection is blind but can be automated; proof-of-concept details available in public advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.176

Vendor Advisory: https://github.com/MISP/MISP/commit/158c8b2f788b75e0d26e9249a75e1be291e59d4b

Restart Required: Yes

Instructions:

1. Backup your MISP instance and database. 2. Update MISP to version 2.4.176 or later using git: 'git pull origin 2.4'. 3. Run update scripts: 'sudo -u www-data bash /var/www/MISP/app/Console/cake Admin runUpdates'. 4. Restart web server: 'sudo systemctl restart apache2' (or your web server). 5. Verify update completed successfully.

🔧 Temporary Workarounds

Input Validation Filter

all

Implement additional input validation for array parameters in custom code

Not applicable - requires code modification

Web Application Firewall

all

Deploy WAF rules to block SQL injection patterns in array parameters

WAF-specific configuration required

🧯 If You Can't Patch

Implement strict network segmentation to isolate MISP instance from sensitive systems
Enable detailed SQL query logging and monitor for injection patterns; restrict database user permissions to minimum required

🔍 How to Verify

Check if Vulnerable:

Check MISP version: navigate to Administration -> Server Settings -> Diagnostics in web interface, or check /var/www/MISP/VERSION.json file for version number.

Check Version:

cat /var/www/MISP/VERSION.json | grep version

Verify Fix Applied:

Confirm version is 2.4.176 or higher; verify commit 158c8b2f788b75e0d26e9249a75e1be291e59d4b is present in git history.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed authentication attempts followed by parameter manipulation
Requests with array parameters containing SQL keywords

Network Indicators:

HTTP POST requests with array parameters containing SQL syntax
Unusual database connection patterns from web server

SIEM Query:

source="misp_access.log" AND (url="*[\"' OR *" OR param="*[\"' OR *" OR user_agent="*sqlmap*")

📊 Metadata

CVE ID: CVE-2023-48655

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-116

Published: November 17, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-48655, you might also want to check these: