External risk intelligence

MISP Opendata Export Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-41326

MISP (Malware Information Sharing Platform) is frequently deployed as a centralized, web-based threat intelligence portal. As a platform intended for collaborative data sharing and export, its web interface and export endpoints are commonly accessible over network perimeters in the organizational environments where it is deployed.

Misp Project Misp

before 2.4.148

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the MISP platform, a tool used for threat intelligence sharing. The issue stems from how the platform handles data during export operations, potentially allowing for malicious code execution. While the specifics of exploitation are complex, the high severity and potential for unauthorized system access warrant attention to confirm if your organization utilizes this technology.

Flaw allows unauthorized code execution via export functions.
Matters for organizations using MISP for threat intelligence.
Confirm MISP usage and exposure to assess risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to the OpenData export feature of MISP. Because this feature processes input that is used in a shell command without proper sanitization, an attacker can inject malicious commands. If successful, this could allow an attacker to execute arbitrary code on the server, leading to a full compromise of the system.

No authentication required for access.
Vulnerable parameter in data export feature.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in MISP's OpenData export functionality could allow an unauthenticated attacker to execute arbitrary commands on the server. This occurs when specific parameters are mishandled within a `shell_exec` call, potentially impacting the integrity and availability of the MISP instance and its data.

Server-side code execution.
Unsanitized input to `shell_exec`.
Compromised server and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MISP platform, used for threat intelligence sharing and export, is likely managed by a dedicated application or platform team. Initial triage should focus on confirming the presence and accessibility of the affected MISP instances. Subsequently, identify the business criticality of each instance and the accountable owner to prioritize remediation efforts, coordinating with vendor-management if necessary.

MISP platform or application owners.
Verify instance reachability and business impact.
Plan remediation based on risk and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MISP and why is it used?

MISP, or Malware Information Sharing Platform, is a specialized, open-source software suite designed to help organizations collect, store, and distribute technical threat intelligence. Security teams use it to automate the sharing of indicators of compromise and correlate data about ongoing cyber threats across different networks and collaborative communities.

How does CVE-2021-41326 work?

This vulnerability is a command injection flaw. It occurs because the application fails to properly clean or validate specific user-provided data before passing it to a system-level command execution function. By sending malicious input through the OpenData export feature, an unauthorized user can force the server to run unintended system commands, effectively gaining control over the underlying platform.

Do I need to be logged in to trigger this bug?

No, authentication is not required to trigger this vulnerability. The flaw exists within an export function that processes incoming data parameters; therefore, an attacker does not need legitimate credentials to reach the vulnerable code path. Simply interacting with the specific OpenData export endpoint with crafted input is sufficient to initiate the faulty command execution.

Is my MISP instance at risk?

Halo Surface Signal indicates that MISP instances are often deployed as web-facing portals to facilitate external data sharing. Because this vulnerability is reachable over a network without authentication, any instance that is accessible from the internet or exposed to untrusted network segments should be considered high priority for review.

When should I take action for this CVE?

You should prioritize this immediately if you operate an instance of MISP version 2.4.147 or earlier. Your first step is to confirm the specific version running in your environment and identify who manages the platform. Coordinate with your application team to verify the instance's network accessibility and prepare to apply the vendor-provided security updates that resolve the parameter handling flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.