CVE-2026-97863: misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values
The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character (e.g., a crafted ip-dst or url attribute value submitted to MISP) breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who subsequently executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key. The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the misp-modules cisco_firesight_manager_ACL_rule_export module so all interpolated configuration and MISP attribute values are passed through Python's shlex.quote(); for the JSON access-rule block, assemble the JSON as plain text and shlex-quote the complete string once before placing it in the shell assignment.
- Compensating control
Initialize the module's 'config' variable to an empty dictionary before the conditional assignment so it is defined when the request payload lacks a 'config' key.
Event History
Frequently Asked Questions
Who is exposed to command execution from this issue?
The immediate execution risk is to a security analyst who generates and then runs the exported .sh file unmodified. An attacker able to submit or influence MISP attribute values or event comments included in the export can place commands into that script.
What input is needed to exploit the injection?
A crafted value containing a single quote can break out of the module's single-quoted shell assignments. The affected inputs include destination IPs, URLs, event information comments, and configuration values such as the IP address, login, password, domain ID, and policy ID.
Is exploitation automatic when a malicious value is stored in MISP?
No. The injected shell commands execute when someone runs the generated shell script; generating or storing the export alone is not described as executing them.
What is the impact if the generated script is executed?
Commands run with the privileges of the analyst executing the script. The described consequences include exposure of fireSIGHT Manager credentials, modification of ACL rules, and compromise of the analyst workstation.
Is there a non-execution impact to consider?
Yes. A separate defect can cause a NameError denial of service when the request payload follows the path where config is not assigned before it is referenced.