CVE-2026-67178

*** Pendiente de traducción *** MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect:<br /> <br /> Redirect permanent / https://misp.example<br /> <br /> Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configured destination URL. Because the destination did not end with /, attacker-controlled path content was appended directly to the hostname rather than to its URL path.<br /> <br /> For example, a request resembling:<br /> <br /> http://misp.example/@attacker.example/<br /> <br /> could result in a redirect resembling:<br /> <br /> https://misp.example@attacker.example/<br /> <br /> Under standard URL parsing, misp.example is interpreted as user information and attacker.example as the destination host. An unauthenticated remote attacker could therefore construct a URL hosted under the legitimate MISP domain that redirects users to an attacker-controlled website.<br /> <br /> The vulnerability could be used for phishing, credential collection, or potentially disclosing sensitive query-string information preserved during the redirect. Exploitation requires a user to follow the crafted HTTP URL.<br /> <br /> The fix adds the missing trailing slash to the redirect destination, ensuring that appended request data remains part of the path on the configured MISP host.<br /> <br /> <br /> <br /> Existing installationsExisting MISP installations should review their Apache HTTP virtual-host configuration and ensure that the HTTPS redirect destination ends with a trailing slash:<br /> <br /> Redirect permanent / https://misp.example/<br /> <br /> After updating the configuration, validate it with apachectl configtest and reload or restart Apache for the change to take effect