CVE-2026-44381 MISP Threat Intelligence Platform Authenticated SQL Injection via ORDER BY Parameter POST /events/index — Boolean-Blind + Time-Based Oracle

1. Introduction

This document illustrates a SQL injection vulnerability in MISP — the Malware Information Sharing Platform and Threat Sharing system — an open-source threat intelligence platform used by over 6,000 organizations worldwide, including national CERTs, financial sector ISACs, government agencies, and security operations teams. The vulnerability, tracked as CVE-2026-44381, allows an authenticated attacker with a valid API key to inject arbitrary SQL into the ORDER BY clause of MISP’s event listing query, enabling both time-based (SLEEP) confirmation and boolean-blind data extraction of any data accessible to the MISP database user — including stored API keys, event metadata, and database internals.

The injection is present in the POST /events/index REST API endpoint’s order parameter, which is passed directly into the CakePHP query builder’s ORDER BY clause without validation against a field whitelist. A carefully crafted order value containing a SQL subquery causes the database to execute arbitrary SQL inside the sort expression — enabling an attacker to use the differential between HTTP 200 (benign order / 0 rows returned) and HTTP 500 (subquery returns >1 row triggering a database error) as a boolean oracle to extract data character by character. The same injection primitive also accepts SLEEP() calls, providing a time-based confirmation channel identical to the one used by the public Nuclei detection template.

The vulnerability is classified as authenticated — an API authkey is required in the Authorization header. However, in many MISP deployments, API keys are widely distributed to analysts, automation pipelines, and integrations, meaning the attack surface is broader than a single privileged credential. The extracted data includes the API authkeys of all MISP users — disclosure of which enables lateral movement to any account on the platform regardless of role.

2. MISP Description

MISP (Malware Information Sharing Platform) is a free and open-source threat intelligence platform developed and maintained by CIRCL (Computer Incident Response Center Luxembourg) and a global community of contributors. It provides a structured database for storing, sharing, and correlating indicators of compromise (IoCs), threat events, malware samples, and threat actor profiles. MISP is used by national cyber security agencies, financial sector ISACs, healthcare organizations, and enterprise security operations centers to share threat intelligence both internally and with trusted partner communities via synchronization feeds.

Because MISP stores sensitive threat intelligence — including classified indicators, internal network information, proprietary detection signatures, and analyst annotations — alongside the API credentials and email addresses of security personnel, a database-level SQL injection carries significant intelligence exposure risk beyond typical web application data breaches. In many deployments, the MISP database user has broad read access across all tables, making the injection oracle a direct path to the complete threat intelligence corpus and all user credential material in the installation.

3. Vulnerability Severity

4. Scope of Impact

This vulnerability affects all MISP installations running versions earlier than 2.5.37. The last confirmed affected release is v2.5.36. The fix was introduced in v2.5.37 via commit 53fc6be7da1c010ca4696a37c6e27bb699377efa, which adds whitelist validation of user-controlled ordering fields through a new Event->findOrder() method covering both EventsController and ShadowAttributesController.

The injection is also present in the ShadowAttributesController::index via its sort parameter, extending the attack surface beyond event listings to shadow attribute (proposed attribute) queries. Any authenticated API client — including analyst tools, SIEM integrations, and automation scripts — that can reach POST /events/index is a potential attack vector, since the authkey required is the same credential class distributed to all platform users.

5. Where is the vulnerability present?

The vulnerability is present in EventsController::__indexRestResponse() in MISP’s CakePHP-based application layer. This method handles POST /events/index REST API requests and constructs the database query used to list events. The critical path is the order field from the JSON request body — in affected versions it is copied verbatim into the CakePHP find() call’s order clause:

The MISP application-level sanitizer in v2.5.36 runs AppModel::validOrderClause(), which restricts the order string to a character-level allowlist [\w_\-.() ] (word characters, underscores, hyphens, dots, parentheses, and spaces). This prevents injection of quotes, commas, equals signs, and angle brackets — but critically, it permits parentheses, which are sufficient to embed SQL subqueries. An attacker can construct valid-charset payloads using only allowed characters:

The boolean oracle uses information_schema.columns as a multi-row source: when the WHERE condition is TRUE, the subquery returns many rows, triggering “Subquery returns more than 1 row” — a MariaDB error that propagates as HTTP 500. When the condition is FALSE, the subquery returns zero rows and the sort expression evaluates to NULL, allowing the query to complete normally as HTTP 200. Binary search over SUBSTRING((expr) FROM p FOR 1) BETWEEN 0xLL AND 0xHH extracts one character per ~7 probes, recovering arbitrary string values from any table accessible to the misp database user.

In MISP v2.5.37, the fix replaces the character-level allowlist with a field-name whitelist in Event->findOrder(): the order value is looked up against a predefined set of valid MISP model field names (e.g. Event.id, Event.timestamp, Event.org_id). Any value not on the whitelist is silently replaced with the default Event.id — the injected subquery never reaches SQL.

6. Risk

An authenticated attacker with any valid MISP API key can use the boolean oracle to extract arbitrary data from any table readable by the MISP database user. The most immediately impactful targets are: the users table (API authkeys for all users, email addresses, password hashes, role assignments), the events table (classified threat intelligence, event titles, analyst notes, timestamps), and the attributes table (all stored indicators of compromise including internal network indicators, malware hashes, and threat actor infrastructure).

Extraction of other users’ API authkeys from the users table is the most direct escalation path: each recovered authkey grants the same API access level as the targeted account — including Organisation Administrator and Site Administrator keys — without any further authentication. A low-privileged analyst account that can reach POST /events/index can therefore bootstrap access to the Site Administrator API key and take full control of the MISP installation, including all synchronized organizations.

The time-based SLEEP() channel is available independently of the boolean oracle and serves as a confirmation primitive: a response delayed by the specified sleep duration proves SQL execution even in environments where HTTP 500 errors are suppressed or sanitized by a reverse proxy. The public Nuclei template uses an 8-second SLEEP with a paired baseline measurement, giving a 4-second differential threshold that is robust against network jitter.

The overall confidentiality impact for the boolean-blind extraction path significantly exceeds the base CVSS 5.3 score when evaluated in the context of MISP deployments: threat intelligence shared under traffic light protocol (TLP) classifications, classified indicators from national security agencies, and internal network visibility data are all accessible through the oracle. The availability impact — from heavy SLEEP injection use — can also degrade MISP performance for all users during sustained extraction.

7. Mitigation

The following actions should be taken immediately on any MISP installation running an affected version:

• Upgrade to MISP v2.5.37 or later — the patched release replaces the character-level sanitizer with a field-name whitelist in Event->findOrder(), eliminating the injection path entirely.
• Apply the fix commit directly if an in-place upgrade is not immediately possible: apply commit 53fc6be7da1c010ca4696a37c6e27bb699377efa — it modifies Event->findOrder(), EventsController, and ShadowAttributesController.
• Rotate all API authkeys — assume any authkey stored in the users table has been extracted if the endpoint was reachable from a potentially hostile API client. Generate new keys via the MISP user management interface.
• Review access logs for POST /events/index requests with order values containing parentheses, SELECT, SLEEP, information_schema, or hex literals (0x) — these are reliable indicators of exploitation attempts.
• Restrict API key distribution — limit API authkey issuance to trusted users and automation accounts with documented need. Review and revoke unused or unknown API keys.
• WAF rule (temporary mitigation): block POST /events/index request bodies whose order field contains parentheses, SELECT, SLEEP, or SQL function syntax.

8. EXPLOIT IMPLEMENTATION

Attack Scenario

The exploit is demonstrated against a self-hosted MISP v2.5.36 instance running in a Docker container on a Linux host. A patched twin running MISP v2.5.37 on port 8295 validates the order field against the whitelist and replaces any non-whitelisted value with the safe default Event.id — the same probe returns HTTP 200 instantly with no SQL execution.

Prerequisites:

• Docker (containers already running — vuln at http://127.0.0.1:8294, patched at http://127.0.0.1:8295)
• API authkey: f1d1f836f9e2a728f757cfc6c1b914c4f1792374 (seeded lab admin key)
• Python 3 with the requests library (auto-installed by exploit.py)
• Nuclei v3.x with the modified template for CVE-2026-44381
• curl for manual time-based probe demonstration
• A terminal (tested on Kali Linux / Ubuntu 22.04)

Exploitation

 📸 Screenshot: Terminal showing curl MISP grep output and the JSON API response confirming the MISP instance is up and the authkey is valid.

 📸 Screenshot: Terminal showing Nuclei output — [CVE-2026-44381] [http] [medium] matched on port 8294, no output on port 8295.

📸 Screenshot: Terminal showing both curl time commands back-to-back — vuln returning ‘200 in 8.3s’ and patched returning ‘200 in 0.2s’, clearly demonstrating the SLEEP timing differential.

📸 Screenshot: Terminal showing both boolean oracle curl commands — TRUE condition returning HTTP 500 and FALSE condition returning HTTP 200, confirming the binary search channel.

📸 Screenshot: Terminal showing full exploit.py output with [!!!] EXPLOITED, extracted MariaDB version, CURRENT_USER, admin authkey, and seeded event row all visible.

📸 Screenshot: Terminal showing mariadb query output — authkey and event info in the database matching the values extracted through the SQL injection oracle.

  ⚠  EXPLOITATION SUMMARY

 Authenticated SQL injection in POST /events/index via the order parameter.

  ORDER BY clause receives attacker-controlled value — no field whitelist in v2.5.36.

  Time-based channel: SLEEP(8) in subquery -> ~8s response delay (nuclei detection primitive).

  Boolean-blind channel: TRUE condition -> HTTP 500, FALSE condition -> HTTP 200.

  Binary search over SUBSTRING BETWEEN extracts any DB string ~7 probes/char.

  Arbitrary table read: VERSION(), CURRENT_USER(), users.authkey, events — all extracted.

  Recovered authkeys grant full API access to other user accounts including Site Admin.