An unauthenticated server-side request forgery (SSRF) vulnerability in the MISP platform allows attackers to perform unauthorized network reconnaissance or trigger requests against internal services.

The vulnerability is a Server-Side Request Forgery (CWE-918) stemming from a logic error in the XML input handling process. An unauthenticated attacker can send a crafted POST request to the cspReport endpoint, forcing the server to issue outbound HTTPS requests to arbitrary destinations.

The vulnerability allows an attacker to probe internal network infrastructure that is otherwise protected by a firewall, potentially exposing internal services to unauthorized interaction. While the CVSS score of 6.9 reflects a medium severity, the ability for an unauthenticated attacker to bypass network perimeters poses a significant risk to the confidentiality and integrity of the internal network environment.

Immediate Action: Update the MISP installation to version 2.5.47 or later, which implements strict validation of XML request bodies.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at the cspReport endpoint, particularly those containing non-XML content or suspicious URL patterns.

Compensating Controls: Implement egress filtering on the MISP server to restrict outbound connections to only known, required external endpoints, effectively neutralizing the SSRF vector even if the application remains unpatched.

Public Exploit Available: Unknown.

The risk posed by this SSRF vulnerability is elevated due to the potential for attackers to gain visibility into internal network segments. Organizations running MISP should prioritize the upgrade to version 2.5.47 immediately to ensure that input validation is correctly applied to all request bodies, thereby closing the identified SSRF path.