Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in certain authentication plugins for MISP could allow unauthorized access without a password, potentially granting attackers the same privileges as legitimate users, including access to sensitive threat intelligence data.
- Bypass authentication to gain user access.
- Sensitive data access is a potential consequence.
- Confirm plugin relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker can impersonate any user on a MISP instance by exploiting a flaw in its authentication plugins. The attacker begins by identifying a valid user's email address. They then send a login request with this email but provide an empty or malformed password. If the MISP instance uses the vulnerable LdapAuth or LinOTPAuth plugins, the system will incorrectly authenticate the attacker as the target user, granting them the user's privileges.
- Requires affected plugin enabled.
- Sends login with valid email, invalid password.
- Grants unauthorized user privileges.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to bypass authentication when the LdapAuth or LinOTPAuth plugins are enabled and an attacker knows a valid user's email address. This could lead to unauthorized access to user accounts and potentially administrative privileges within the MISP instance.
- User account access.
- Unauthenticated login bypass.
- Unauthorized access to threat intelligence.
Operational Fix
Recommended remediation, mitigation, and detection steps
MISP administrators and platform teams are responsible for securing authentication mechanisms. The first practical step is to identify all MISP instances using the affected plugins, determine their exposure, and locate the accountable owner for remediation.
- Identify MISP instances with affected plugins.
- Verify exposure and business criticality.
- Plan remediation with vendor coordination.
