CVE-2026-97863
Received Received - Intake

Command Injection in MISP misp-modules

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CIRCL

Description
The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character (e.g., a crafted ip-dst or url attribute value submitted to MISP) breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who subsequently executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key. The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97863
EUVD
EUVD-2026-86584

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cisco firesight_manager *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a shell command injection flaw in the cisco_firesight_manager_ACL_rule_export module of MISP. It occurs because the module directly inserts user-controlled values like IP addresses, URLs, or comments into a shell script without proper escaping. If these values contain a single quote, they can break out of the shell string context and inject arbitrary commands into the generated script.

Detection Guidance

Check for MISP modules using the vulnerable cisco_firesight_manager_ACL_rule_export module. Inspect generated .sh files for improperly escaped single quotes in IP addresses, URLs, or event comments. Look for scripts containing unquoted or improperly sanitized user-controlled input.

Impact Analysis

An attacker with MISP event submission privileges could craft malicious input containing a single quote to inject shell commands. If a victim executes the generated script, these commands run with the victim's privileges. This could expose Cisco fireSIGHT Manager credentials, modify ACL rules, or compromise the analyst's workstation.

Mitigation Strategies

Update the misp-modules package to the latest version containing the fix. Ensure all generated shell scripts are reviewed before execution. Validate that user-submitted attributes in MISP do not contain single quotes or other special characters that could lead to command injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart