External risk intelligence

MISP Logo Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-29858

MISP is typically deployed as a web-based threat intelligence platform. As a collaboration tool intended to ingest and share data across organizational boundaries, it is commonly exposed as an internet-facing web application or API endpoint to facilitate exchange with other platforms and partners.

Misp Project Misp

before 2.4.187

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the MISP threat intelligence platform, allowing unauthenticated access to upload unauthorized files. The issue, if exploited, could lead to significant compromise of the platform's integrity and the data it holds. The primary concern for leadership is to confirm if MISP is deployed within the organization and assess potential exposure.

Unauthorized file uploads can compromise system integrity.
Critical vulnerability in threat intelligence sharing platform.
Confirm MISP usage and assess business exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by accessing the web application and initiating an organization logo upload. The application fails to properly validate the uploaded file, allowing for potentially malicious content to be processed. This could lead to significant compromise of the system's confidentiality, integrity, and availability.

No authentication required.
Uploading a specially crafted file.
Full system compromise possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in MISP could allow an unauthenticated attacker to upload arbitrary files when supported by the advisory. This could potentially lead to the compromise of the MISP instance.

Arbitrary file upload capability.
Unauthenticated remote file upload.
Potential system compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in MISP's logo upload functionality requires immediate attention, likely from application owners and infrastructure teams responsible for maintaining the MISP deployment. The first practical step is to identify all instances of the affected MISP system, confirm its network exposure and business criticality, and then determine the accountable owner to plan remediation.

Application owners should address the issue.
Verify system exposure and criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MISP platform used for?

MISP is a threat intelligence platform used by organizations to collect, store, and share information about cyber threats. It functions as a collaborative environment where security teams exchange data about malicious actors and indicators of compromise to better protect their own networks. Because it acts as a central hub for sensitive intelligence, it is often configured to interact with various other security tools and external partners.

What does CWE-616 mean in CVE-2024-29858?

CWE-616 refers to an 'Incomplete Filtering of Special Elements,' which means the software does not properly check or sanitize the content it receives. In the context of CVE-2024-29858, the platform's logo upload function fails to verify that the file being submitted is actually a legitimate image. Because this filter is missing, the application might mistakenly accept and process harmful files disguised as logos.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the logo upload feature within the organization management section of the platform. The vulnerability does not require any login credentials or special user access to initiate. It is important to note that simply visiting the MISP web page or browsing existing content does not trigger this issue; the attacker must actively send a specially crafted, malicious file through the upload process.

Is my MISP instance at risk?

According to Halo Surface Signal, MISP is commonly deployed as an internet-facing web application or API to facilitate data sharing, which often places it directly within the reach of remote attackers. If your instance is accessible from the public internet, it faces a higher level of risk. You should prioritize assessing your environment if your platform is configured to be reachable outside of your internal network.

How should I respond to this threat?

The first step is to locate all instances of MISP running within your environment to understand your total footprint. Once you have identified your systems, confirm which ones are on versions older than 2.4.187 and determine who is responsible for managing them. Coordinate with those owners to verify network exposure and plan for an update to a secure version to resolve the flaw.

References

github.com/MISP/MISP/commit/6a2986be6aad6b37858b4869e238f517b295…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.