Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in MISP's authentication system that could allow an unauthenticated attacker to impersonate an existing user. Successful exploitation could lead to unauthorized access to sensitive threat intelligence data, modification or deletion of information, and other privileged operations, particularly if an administrative account is compromised. The main concern is confirming relevance and exposure.
- Bypass user authentication via weak credentials.
- Critical access risk to sensitive threat data.
- Verify MISP relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker could bypass authentication in MISP by identifying a valid user's email address and submitting an empty password. This vulnerability exists because the custom LDAP and LinOTP authentication components do not adequately validate user-supplied credentials, allowing empty or invalid values to reach the underlying authentication mechanisms. If successful, an attacker could impersonate a legitimate user, potentially gaining administrative access to sensitive data, altering configurations, or performing other privileged actions.
- Attacker needs only an email address.
- Triggered by empty or invalid credentials.
- Risk of unauthorized administrative access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated remote attacker to impersonate existing MISP users, potentially gaining access to sensitive threat intelligence data, modifying or deleting information, or altering system configurations when the LDAP or LinOTP authentication components are used.
- Access to sensitive threat intelligence data.
- Bypass authentication via empty credentials.
- Unauthorized privileged operations.
Operational Fix
Recommended remediation, mitigation, and detection steps
The MISP platform's authentication components are the responsibility of the team managing MISP instances and their integrations. This could be an internal security operations team, a threat intelligence team, or an infrastructure team depending on how MISP is deployed. The first practical step is to identify all MISP instances, verify network exposure and business criticality, locate the accountable owner for each instance, and then plan remediation based on the assessed risk.
- MISP administrators or security operations.
- Confirm network reachability and instance criticality.
- Plan and coordinate an update for affected instances.
