MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

Overview

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.

As a result:

• All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.

• When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.

This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.

Affected: <2.5.48.

Affected

• MISP < 2.5.48

Remediation

The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.