CyberRota Analysis
AI-GeneratedMISP is vulnerable due to the inclusion of PHP's phar stream wrapper, which allows attackers to exploit filesystem operations on manipulated paths, leading to implicit unserialization and potential arbitrary code execution. This vulnerability poses a significant risk, particularly for environments where user input can influence filesystem paths. Organizations using MISP should prioritize addressing this issue to mitigate the risk of remote code execution and ensure the integrity of their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink; - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user. No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.