CVE-2017-13671 in MISP
Summary
by MITRE
app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/23/2026
CVE-2017-13671 represents a persistent cross-site scripting vulnerability discovered in the MISP (Malware Information Sharing Platform) software version 2.4.79 and earlier. This vulnerability exists within the CommandHelper.php file located in the app/View/Helper directory of the MISP application. The flaw allows attackers to inject malicious scripts into comment fields that are then persisted within the application's database, making the vulnerability particularly dangerous as it can affect multiple users who view these comments.
The technical implementation of this vulnerability stems from insufficient input sanitization and output encoding within the comment handling functionality of the MISP platform. When users create comments within the system, the application fails to properly sanitize the input data before storing it in the database. This oversight allows malicious actors to embed script tags or other malicious code within comment fields that are subsequently executed whenever other users view these comments. The vulnerability specifically affects the CommandHelper.php component which is responsible for handling command-related functionality and comment display within the MISP interface.
The operational impact of this persistent XSS vulnerability is significant within the context of threat intelligence sharing platforms like MISP. Since MISP is designed for collaborative threat intelligence sharing among security professionals, the vulnerability creates a potential attack vector where malicious actors could compromise the systems of other users within the same MISP instance. The fact that this vulnerability only impacts users of the same instance is both a limitation and a concern - while it prevents cross-instance propagation, it still allows for targeted attacks against specific organizations using the same MISP deployment. This makes the vulnerability particularly dangerous in multi-tenant environments where multiple organizations share a single MISP instance.
The vulnerability aligns with CWE-79 Cross-site Scripting and follows the ATT&CK technique T1059.007 Command and Scripting Interpreter: JavaScript, demonstrating how attackers can leverage web application vulnerabilities to execute malicious code in the context of the victim's browser. The persistence aspect of this vulnerability means that once the malicious script is injected, it remains active until manually removed from the database, potentially affecting all users who access the affected comments. This makes the vulnerability particularly concerning for security operations centers that rely on MISP for threat intelligence sharing and collaboration.
Organizations using MISP should immediately upgrade to version 2.4.79 or later to remediate this vulnerability. The fix implemented in version 2.4.79 includes proper input validation and output encoding mechanisms that sanitize comment fields before storage and rendering. Additionally, administrators should implement regular security monitoring of comment fields and consider implementing web application firewalls to detect and prevent XSS attempts. The vulnerability serves as a reminder of the critical importance of input validation in web applications, particularly in collaborative platforms where user-generated content can be viewed by multiple parties within the same system.