CVE-2026-85547— Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept header. Because Accept: application/json can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim's existing browser session. An unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker's page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim's privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes. The vulnerability originates from granting the form-security exemption based on _isRest() rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection. The fix also introduces support for transmitting CSRF tokens through the X-CSRF-Token header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:L/SA:H

跨站请求伪造(CSRF)

MISP 跨站请求伪造漏洞

MISP是MISP组织开源的一个威胁情报共享与分析平台。 MISP 2.5.45及之前版本存在跨站请求伪造漏洞，该漏洞源于基于_isRest()方法错误地禁用表单安全和CSRF保护，可能导致跨站请求伪造攻击，进而利用受害者权限执行未授权的修改、创建、发布或删除数据等操作。

N/A

N/A