CVE-2026-44381

Vulnerability

In MISP versions prior to 2.5.37, the event and shadow attribute listing endpoints accepted user-controlled order or sort parameters and incorporated them directly into SQL ORDER BY clauses without sufficient validation. The affected code did not validate the requested field name against a whitelist of allowed model fields, enabling an attacker to inject arbitrary SQL via the ordering parameter [1].

Exploitation

An attacker with access to the affected endpoints (typically an authenticated user with permissions to view event or shadow attribute listings) can craft a malicious order or sort parameter. No additional user interaction is required; the injection occurs when the server processes the request and builds the SQL query [1].

Impact

Successful exploitation allows the attacker to manipulate the generated SQL query, potentially leading to unauthorized access to data, modification of query behavior, or other database-level impacts depending on the database user's permissions and query context [1].

Mitigation

The vulnerability is fixed in MISP version 2.5.37, released on 2026-05-13. The fix removes direct use of the user-supplied order parameter, validates requested ordering fields against allowed model fields or the model schema, and constructs the order clause using validated field names and normalized sort directions only [1]. No workarounds are documented; upgrading to the patched version is recommended.