Executive Summary

This vulnerability in MISP allows an authenticated site administrator to set the Kafka_rdkafka_config setting to point to any arbitrary filesystem path. MISP then parses the referenced INI file and passes its options to the rdkafka library. An attacker who controls the configuration file can exploit rdkafka options, such as plugin.library.paths, to load an external malicious library. This leads to arbitrary code execution with the privileges of the MISP process.

The attacker can place the malicious configuration file in a MISP-writable location, like an uploaded file or administrative image, to carry out the attack. The vulnerability is fixed by restricting the Kafka_rdkafka_config setting to only accept absolute .ini files located in approved configuration directories outside the webroot and MISP upload targets.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution on the server running MISP with the privileges of the MISP process. An attacker exploiting this flaw could execute malicious code, potentially compromising the entire system, accessing sensitive data, or disrupting services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, restrict the Kafka_rdkafka_config setting to absolute .ini files located only in approved configuration directories outside the webroot and MISP upload targets.

Useful 0 Not Useful 0