An unauthenticated attacker can perform unauthorized actions within MISP by tricking an administrator into executing malicious workflow modules via a cross-site request forgery attack.

This is a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) stemming from the incorrect inclusion of the moduleStatelessExecution action in the CakePHP unlockedActions list. This misconfiguration disables CSRF protections, allowing an attacker to craft requests that, when triggered by an authenticated administrator, execute arbitrary workflow modules with high integrity impact.

Successful exploitation allows an attacker to manipulate security-related data within the MISP instance, such as modifying blocklists or warninglists. While the CVSS score is 6.9, the ability for an attacker to influence threat intelligence data integrity poses a significant risk to the reliability of security operations and incident response processes.

Immediate Action: Upgrade your MISP instance to version 2.5.47 or later to restore proper CSRF token validation.

Proactive Monitoring: Review audit logs for suspicious or unauthorized modifications to workflow configurations, blocklists, or warninglists that deviate from standard administrative patterns.

Compensating Controls: Ensure that administrative sessions are protected by strict browser security policies and that users avoid navigating to untrusted external sites while logged into the MISP administrative interface.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing MISP must prioritize the upgrade to version 2.5.47 as soon as possible to mitigate the risk of unauthorized data manipulation. Given the nature of CSRF attacks, administrators should remain vigilant against social engineering attempts that could lead to the unintended execution of malicious requests while logged into the platform.