CVE-2026-97863 in misp-modules
Summary
by MITRE • 09/25/2026
The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character (e.g., a crafted ip-dst or url attribute value submitted to MISP) breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who subsequently executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key. The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Cisco fireSIGHT Manager ACL rule export module within misp-modules contains a critical command injection vulnerability stemming from improper handling of user-supplied input during shell script generation. This module is designed to authenticate with the Cisco fireSIGHT Manager API and generate an executable shell script that applies Access Control List rules based on data retrieved from MISP threat intelligence events. The core technical flaw lies in how configuration values, such as IP addresses, login credentials, domain IDs, policy IDs, along with MISP attribute values like destination IPs, URLs, and event comments, are interpolated into the generated script. These values are inserted directly into single-quoted shell string assignments without any form of escaping or sanitization. In standard POSIX-compliant shells, single quotes preserve the literal value of all characters enclosed within them; however, a closing single quote terminates the quoted context immediately. Consequently, if an attacker submits a MISP attribute containing a single-quote character, they can break out of this quoting mechanism. This allows for the injection of arbitrary shell commands that will be executed by whatever user runs the generated script.
The operational impact of this vulnerability is severe and multifaceted. A security analyst who receives or generates these scripts as part of their routine threat intelligence workflow may unknowingly execute a maliciously crafted file. Because the injected commands run with the privileges of the executing user, an attacker can achieve remote code execution on the analyst's workstation. This access can be leveraged to exfiltrate sensitive credentials stored in the script environment or configuration files, modify ACL rules on the fireSIGHT Manager to bypass security controls, or establish persistence within the organization's network infrastructure. The vulnerability does not require authentication bypass beyond standard MISP event submission privileges, meaning any user with write access to create events or attributes can exploit this flaw. This significantly lowers the barrier for attack and increases the likelihood of successful exploitation in environments where threat intelligence sharing is active.
In addition to the command injection issue, the module exhibits a secondary defect related to variable initialization that leads to a denial of service condition. The variable named config is assigned only within a conditional block but is referenced unconditionally later in the script execution flow. If an incoming request payload lacks the required config key, this reference triggers a NameError exception. This error causes the script to fail abruptly before any security controls or API calls can be made. While primarily resulting in service disruption for legitimate users attempting to export ACL rules, it also indicates poor code quality and lack of defensive programming practices that could potentially mask other issues or complicate incident response efforts by generating noisy failure logs rather than graceful error handling.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as Operating System Command Injection. The root cause is the direct interpolation of unsanitized user input into shell commands without proper escaping mechanisms such as those provided by functions like shlex.quote or similar language-specific safe string formatting methods. Furthermore, the attack vector corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving Unix Shell scripts. The exploitation relies on social engineering elements where a victim is induced to execute a file that appears legitimate but contains hidden malicious payloads embedded within standard threat intelligence data fields.
Mitigation strategies must address both the immediate code flaw and broader operational practices. Developers should immediately patch the misp-modules package by implementing strict input validation and using safe string interpolation methods that escape special shell characters before embedding them in command strings. Specifically, all user-supplied values including IP addresses, URLs, and comments must be passed through a sanitization function that neutralizes single quotes and other metacharacters. Additionally, the variable initialization logic should be corrected to ensure config is defined with a default value or checked for existence prior to use to prevent NameError exceptions. For organizations currently using this module, it is recommended to disable the specific export functionality until an updated version is available. Security analysts should also adopt operational procedures that verify the integrity of generated scripts before execution and avoid running untrusted shell scripts directly from threat intelligence platforms without manual review or sandboxing.