Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in MISP when using the Overmind theme. It occurs because the setHomePage endpoint saved a user-controlled path value without proper validation, bypassing the usual checks that require homepage paths to start with a '/'. An authenticated user could therefore store an arbitrary homepage value, including malicious JavaScript code.

Later, this stored value was rendered in the application as the href attribute of a "Continue to homepage" link without HTML escaping. This allowed the execution of attacker-controlled JavaScript in the browser of anyone viewing the affected MISP instance when they interacted with the crafted homepage link.

The issue was fixed by ensuring the homepage setting is always saved through the proper validation function and by HTML-escaping the homepage value before rendering it.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user to inject and store malicious JavaScript code within the MISP application. When other users view the affected page, the malicious script can execute in their browsers.

Potential impacts include theft of user session data, unauthorized actions performed on behalf of users, redirection to malicious sites, or other malicious behaviors enabled by executing attacker-controlled scripts in the context of the affected application.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the MISP instance is updated to a version where the homepage setting is always persisted through the setSetting() method, which applies proper validation and access checks.

Additionally, verify that the homepage value is HTML-escaped before rendering it in the news view to prevent execution of attacker-controlled JavaScript.

Useful 0 Not Useful 0