MISP 2.4.175 SQL Injection Vulnerabilities (CVE-2023-48657/48658) Advisory

Critical Vulnerability Information Date: September 13, 2023 Affected Vendor: CIRCL – Computer Incident Response Center Luxembourg Affected Product: MISP – Malware Information Sharing Platform & Open Standards For Threat Information Sharing (https://www.misp-project.org/) Vulnerable Version: 2.4.175 Fixed Version: 2.4.176 CVSS Score: 7.2 High (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Recommended Action: Upgrade to the latest MISP version Vulnerability Details: - In certain endpoints, a critical parameter from the POST request body is inserted into an SQL query without proper escaping or validation. An authenticated attacker can exploit this vulnerability to perform a time-based SQL injection attack, thereby gaining access to various information within the database, including password hashes, API keys, etc. CVE: - CVE-2023-48657 - CVE-2023-48658 Discoverer: Dawid Czarnecki References: - CVE-2023-48657: - https://cvepremium.circl.lu/cve/CVE-2023-48657 - https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 - https://github.com/MISP/MISP/commit/08bd23281ead288de678de666ef43ed6de1899fc - CVE-2023-48658: - https://cvepremium.circl.lu/cve/CVE-2023-48658 - https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 - https://github.com/MISP/MISP/commit/168621521b57b2437331174186f84a6aa3e71f0d

Goal Reached Thanks to every supporter — we hit 100%!

MISP 2.4.175 SQL Injection Vulnerabilities (CVE-2023-48657/48658) Advisory