An authenticated site administrator can leverage an unrestricted file upload vulnerability in the MISP blocklist workflow module to achieve arbitrary code execution on the server.

This vulnerability is an unrestricted file upload flaw (CWE-434) within the blocklist workflow module. By providing a crafted filename parameter, a site administrator can bypass existing sanitization to place files with executable extensions into the web server directory.

A successful exploit results in a total compromise of the MISP server, as the attacker achieves the same privilege level as the web server process. This allows for full loss of confidentiality, integrity, and availability of the platform. Given the high CVSS score of 8.6, this flaw poses a significant risk to organizational data and operational continuity.

Immediate Action: Update MISP to version 2.5.47 or later, which enforces a strict whitelist of allowed file extensions for the blocklist filename parameter.

Proactive Monitoring: Review web server access logs for requests targeting the MISP export directory and monitor for unauthorized file creation events or unusual script execution patterns.

Compensating Controls: Ensure the web server hosting the MISP export directory is configured to disable script execution in that location, preventing the invocation of uploaded malicious files.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention, particularly in environments where administrative accounts may be compromised. Administrators must update to version 2.5.47 immediately to remediate the underlying input validation failure. Beyond patching, organizations should verify that their web server security policies restrict script execution within user-writable directories to provide defense-in-depth.