Misp Guard
Monthly
Case-sensitivity defects in MISP Guard's feed-distribution policy checks allow an authenticated MISP event creator to slip events past configured TLP taxonomy, allowed-tag, blocked-attribute-category and blocked sharing-group rules simply by changing the letter case of a tag, category or UUID string, with the result that threat-intelligence data the operator meant to restrict is still forwarded to feed consumers. Only deployments running misp-guard 1.3 or earlier that actually rely on these allow/block policies are exposed, and the impact is confidentiality-only - no integrity or availability effect. No public exploit code was identified at time of analysis; the vendor has published an upstream fix commit (9868b1d9) that normalizes case on both sides of every affected comparison and adds regression tests reproducing the bypass.
Feed filtering bypass in MISP mispguard allows a compromised or attacker-controlled MISP feed host to push unfiltered event data into the protected MISP instance by answering with any 2xx status other than 200 (201 Created, 203 Non-Authoritative Information, 206 Partial Content), because the pre-patch process_feed_response logic only reasoned about the non-200 case and let every other successful code through untouched. The attacker must already control or have compromised a feed endpoint configured and polled by that MISP instance; from there no authentication or user interaction is required beyond the feed polling loop already in place. Upstream fix commit b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735 changes these responses to a 403 block, no public exploit was identified at time of analysis and active exploitation is not confirmed (CISA KEV), and vuln.today priority is this_week.
MISP Guard releases before 1.4 enforce required-taxonomy rules incompletely, so a feed proxy configured to distribute only lower-classification data can be made to pass events and attributes marked with a higher classification. An authenticated user able to author or modify events in a proxied feed source can attach an allowed tag (for example tlp:clear) together with a non-allowed tag of the same taxonomy (tlp:red or tlp:amber) to an event, an attribute, an attribute nested in an object, or a shadow attribute, and the guard's policy check still permits distribution - disclosing more sensitive data to feed consumers than policy intends. No public exploit has been identified at time of analysis; this is a moderate-severity data-handling bypass rather than a high-urgency emergency, and the upstream fix is commit 6127d94c350e4dfe31fd4426ba26f51294ed3867 with the affected range listed as misp-guard 0 to <1.4.
Case-sensitivity defects in MISP Guard's feed-distribution policy checks allow an authenticated MISP event creator to slip events past configured TLP taxonomy, allowed-tag, blocked-attribute-category and blocked sharing-group rules simply by changing the letter case of a tag, category or UUID string, with the result that threat-intelligence data the operator meant to restrict is still forwarded to feed consumers. Only deployments running misp-guard 1.3 or earlier that actually rely on these allow/block policies are exposed, and the impact is confidentiality-only - no integrity or availability effect. No public exploit code was identified at time of analysis; the vendor has published an upstream fix commit (9868b1d9) that normalizes case on both sides of every affected comparison and adds regression tests reproducing the bypass.
Feed filtering bypass in MISP mispguard allows a compromised or attacker-controlled MISP feed host to push unfiltered event data into the protected MISP instance by answering with any 2xx status other than 200 (201 Created, 203 Non-Authoritative Information, 206 Partial Content), because the pre-patch process_feed_response logic only reasoned about the non-200 case and let every other successful code through untouched. The attacker must already control or have compromised a feed endpoint configured and polled by that MISP instance; from there no authentication or user interaction is required beyond the feed polling loop already in place. Upstream fix commit b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735 changes these responses to a 403 block, no public exploit was identified at time of analysis and active exploitation is not confirmed (CISA KEV), and vuln.today priority is this_week.
MISP Guard releases before 1.4 enforce required-taxonomy rules incompletely, so a feed proxy configured to distribute only lower-classification data can be made to pass events and attributes marked with a higher classification. An authenticated user able to author or modify events in a proxied feed source can attach an allowed tag (for example tlp:clear) together with a non-allowed tag of the same taxonomy (tlp:red or tlp:amber) to an event, an attribute, an attribute nested in an object, or a shadow attribute, and the guard's policy check still permits distribution - disclosing more sensitive data to feed consumers than policy intends. No public exploit has been identified at time of analysis; this is a moderate-severity data-handling bypass rather than a high-urgency emergency, and the upstream fix is commit 6127d94c350e4dfe31fd4426ba26f51294ed3867 with the affected range listed as misp-guard 0 to <1.4.