CVE-2026-95679: MISP Unauthenticated Blind SSRF via XML Body Processing
MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http || https), where PHP operator precedence causes the https branch to bypass the readFile check entirely. As a result, a request body containing a bare HTTPS URL is treated as a locator and fetched by the server. Because the cspReport endpoint accepts XML content type and is unauthenticated by design, an unauthenticated remote attacker can send a POST request with a crafted XML body to cause the MISP server to issue an outbound HTTPS request to an arbitrary target reachable from the server.
The attacker does not receive the response body, but can use the vulnerability to probe internal services, trigger actions on internal HTTPS endpoints, or perform timing-based reconnaissance of the server's network environment.
The vulnerability affects any MISP deployment where the cspReport endpoint is reachable and the server has network access to internal or external HTTPS services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Implement a custom XML input type handler in AppController::beforeFilter() that validates the request body contains the '<' XML document marker before passing it to the XML decoder, so non-XML bodies cannot reach the Xml::build() locator/fetch path.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Any MISP deployment is affected if its cspReport endpoint is reachable and the MISP server can make network connections to internal or external HTTPS services. The endpoint is unauthenticated by design, so an attacker does not need a MISP account.
What does an attacker need to exploit it?
An attacker needs network access to send a POST request to the cspReport endpoint with an XML content type and a crafted body containing a bare HTTPS URL. Successful exploitation also depends on the target being reachable from the MISP server.
Can an attacker read data returned by an internal service?
No response body is returned to the attacker. However, the attacker can use outbound requests for internal service probing, triggering actions on reachable HTTPS endpoints, or timing-based network reconnaissance.
What can be done if patching is not immediately possible?
Restrict access to the cspReport endpoint where possible and limit the MISP server's outbound network access, particularly access to internal HTTPS services and unnecessary external destinations. These measures reduce the targets that a crafted request can reach.