External risk intelligence

MISP Attachment Downloader Access Control Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2020-15411

MISP (Malware Information Sharing Platform) is commonly deployed as a web-based application intended for collaboration and data exchange, often residing on network edges or internet-facing servers to facilitate intelligence sharing between organizations.

Misp Project Misp

2.4.128

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in MISP, a platform used for sharing threat intelligence. The issue allows unauthorized access to attachments within the application, potentially impacting the confidentiality and integrity of shared data. The main concern is confirming relevance and exposure within our environment.

Unauthorized access to shared threat data.
Important for understanding potential data exposure.
Confirm relevance and exposure in our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by accessing a specific feature within the MISP application that handles file downloads. If the application fails to properly verify the user's permissions before allowing a download, an unauthorized individual could potentially access or manipulate sensitive attachments. This could lead to a compromise of data confidentiality, integrity, and availability.

No specific access required.
Triggered by downloading attachments.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to download any file from the MISP server when supported by the advisory's configuration. This means sensitive system files or configuration data could be accessed and potentially modified or deleted by an unauthorized party.

System files and sensitive data.
Via unauthenticated access to attachment downloader.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that MISP is a web-based application often deployed for inter-organizational data exchange, the platform or infrastructure teams are likely responsible for its upkeep. The initial step involves identifying all MISP instances, assessing their business criticality and network exposure, and locating the accountable owners before planning remediation efforts.

Platform/Infrastructure teams own the issue.
Verify MISP instance exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MISP platform?

MISP, or Malware Information Sharing Platform, is an open-source software suite designed to help organizations collect, store, and distribute technical indicators of compromise. It acts as a central repository where teams collaborate to exchange threat intelligence, often facilitating automated security defenses across different networks or industry partners.

How does CVE-2020-15411 affect MISP?

This vulnerability is an access control failure. In software security, this occurs when an application does not correctly verify a user's identity or permissions before granting access to a resource. In this specific case, the flaw allows unauthorized users to interact with the attachment downloader, bypassing security checks intended to restrict access to shared files.

Do I need to be logged in to trigger this bug?

No. The vulnerability enables unauthenticated access to the file download functionality. An attacker does not need to possess valid user credentials or perform a complex authentication bypass to interact with the system. Simply accessing the vulnerable controller path in the application is sufficient to attempt the unauthorized download of files.

Is my MISP instance at risk?

According to Halo Surface Signal, MISP is frequently deployed on network edges or internet-facing servers to enable data exchange between organizations. If your instance is accessible from the internet, it is a high priority for review, as the application's intended design for collaboration often places it in a position where unauthorized network-based access is possible.

When should I take action for this vulnerability?

You should prioritize assessing your environment immediately. Start by creating an inventory of all MISP instances to confirm which ones are active. Once identified, evaluate the network placement of each server to determine if they are reachable by unauthorized parties. Coordinate with the teams responsible for your infrastructure to track the vulnerability status and prepare for updates.

References

github.com/MISP/MISP/commit/d14ce7de709cdde3ecc9433e38e14c682894…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.