A high-severity file-handling vulnerability in MISP allows authenticated attackers to perform unauthorized file reads or internal network requests, posing a significant risk to data confidentiality.

This vulnerability is caused by insufficient validation of XML file uploads, which permits attackers to supply local file paths or URLs instead of XML data. Exploitation requires an authenticated user with data modification permissions, allowing the server to perform actions on the attacker's behalf.

The ability to read local server files and perform requests against internal network services can lead to the exposure of highly sensitive configuration data, credentials, and internal infrastructure maps. With a CVSS score of 8.3, this vulnerability represents a significant threat to internal security, as it facilitates lateral movement and data exfiltration within the organization.

Immediate Action: Update the MISP instance to version 2.5.47 or later, which implements strict input validation and disables file-fetching capabilities in the XML parser.

Proactive Monitoring: Review web server and application logs for unusual file access patterns or unexpected outbound requests originating from the MISP server to internal network segments.

Compensating Controls: Ensure the MISP application is running with the principle of least privilege, restricting its ability to access sensitive filesystem paths or communicate with unnecessary internal network services.

Public Exploit Available: No (exploit_available unknown).

Given the potential for unauthorized access to sensitive internal resources, organizations should prioritize upgrading their MISP installation to version 2.5.47 immediately. Administrators must ensure that the update is applied across all instances to eliminate the risk of server-side request forgery and unauthorized file exposure.