External risk intelligence

MISP Component SQL Injection Vulnerability CVE-2022-48328

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-48328

MISP (Malware Information Sharing Platform) is a platform typically deployed as a web application to facilitate the sharing of threat intelligence, often requiring external or network-wide accessibility to fulfill its role in coordinating between organizations and security teams.

Misp Project Misp

before 2.4.167

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the MISP platform, a system used for sharing threat intelligence. This issue could allow unauthorized access and manipulation of data if exploited. The main concern is confirming the relevance and exposure of this system within our environment.

Unhandled input allows potential data compromise.
Crucial for threat intelligence sharing platforms.
Verify if MISP is in use for risk assessment.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability through the network without any authentication or user interaction. By targeting a component that processes ordered URL parameters and additional delimiters, an attacker could potentially manipulate how data is handled, leading to severe consequences.

Accessible via network, no privileges needed.
Vulnerable component handles URL parameters.
Allows complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to affect the integrity and availability of the system, and potentially access sensitive information. The issue lies in how the application handles specific parameters in its URL processing.

System data integrity and confidentiality may be impacted.
Exposure could happen via network requests.
Unauthorized data access or modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MISP platform is likely managed by a security operations or threat intelligence team, as it's designed for sharing threat information. The initial focus should be on identifying all instances of the affected MISP application, assessing their exposure and business criticality, and locating the technical owners responsible for each instance. A risk-based remediation plan can then be developed, potentially involving coordination with vendor management if MISP is provided as a service.

Security/Threat Intel teams own the issue.
Verify MISP deployment exposure and criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MISP platform?

MISP, or Malware Information Sharing Platform, is an open-source tool built to help organizations collect, store, and distribute technical indicators of compromise and other threat intelligence. It functions as a collaborative web-based environment where security teams exchange data about ongoing cyber threats to improve collective defensive posture.

What is the weakness in CVE-2022-48328?

This vulnerability is classified as CWE-755, which involves the improper handling of special elements in input. Specifically, the MISP component responsible for processing URL parameters fails to correctly validate or sanitize input data. This flaw allows an attacker to inject unauthorized database queries into the system, potentially bypassing standard security controls to read or modify sensitive information stored within the application.

How can an attacker trigger this vulnerability?

An attacker triggers this issue by sending a specially crafted network request to the vulnerable MISP component that handles URL parameters. No authentication or user interaction is required to initiate the attack. Crucially, simply navigating the application legitimately or using standard, properly formatted URL requests does not trigger the flaw; it requires the inclusion of specific, malicious delimiters designed to manipulate backend database logic.

Is my MISP instance at risk?

According to Halo Surface Signal, MISP is often deployed as a web application intended to be reachable over a network to facilitate threat intelligence sharing between different organizations. Because this vulnerability is accessible via the network without authentication, any instance that is reachable from the internet or exposed to an untrusted internal network should be considered high priority for review.

What should I do to address this CVE?

Your first step is to inventory all instances of MISP within your environment to identify which versions are running. If you are using a version older than 2.4.167, you should prioritize updating the software to a patched release. Since this is a critical component for sharing security data, coordinate with your threat intelligence or infrastructure teams to schedule maintenance and verify that the update successfully mitigates the input handling flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.