This vulnerability exposes a trust boundary failure in MISP's STIX import pipeline: the parser selection logic automatically interprets classification signals embedded in the document itself — tool labels, document titles — as authoritative. The problem is these signals are fully controlled by whoever produces the STIX document. When your import logic says 'if this says MISP, use the internal parser,' you're making a security decision based on an assertion any external actor can make about themselves.
The immediate fix introduces an explicit classification parameter, requiring callers to override auto-detection. This is technically correct for the CWE-915 finding (unrestricted attribute modification) — the allow-list approach to attribute fields is the right move. But the override parameter creates a new problem that most guidance will miss: multi-hop attack surface. When MISP instance A exports STIX to instance B, and B imports it, the override parameter becomes externally controllable again if an intermediary adds it based on document metadata from an earlier processing stage. The vulnerability's root cause — trusting classification signals embedded in the document — now applies to a parameter that may derive from those same signals.
More critically, this is a predictable mutation in a well-documented lineage. CWE-807 (relying on untrusted input for security decisions) describes exactly this pattern: attacker spoofs the trust signal, defender makes it opt-in, attacker spoofs the opt-in channel. Email headers, OAuth scopes, and now STIX metadata have all followed this cycle. The override parameter doesn't break it — it just delays the next CVE. The real fix would require parser selection to depend on something the document cannot control: caller's organizational context, cryptographic assertions, deployment-time configuration.
The blast radius here is severe and often undersold. MISP attributes don't sit dormant — they feed automated threat response, correlation engines, and sharing decisions. Poisoning the distribution field, sharing_group_id, or tags on an imported attribute corrupts the inputs to every downstream system that consumes it. One forged STIX bundle could redirect sensitive indicators to unintended recipients or tag attributes with attacker-controlled labels that trigger automated responses. The vulnerability rewards reach, not sophistication.
If you're defending MISP deployments, the override parameter is necessary but insufficient. Three concrete actions: First, audit every integration point that calls STIX import — ensure callers are explicitly passing classification parameters and not relying on auto-detection. Second, implement logging that captures what the document claimed versus what the import pipeline allowed — the fix creates an audit hole where override usage is invisible to forensic investigation. Third, treat any STIX import from external sources (sharing partners, threat feeds, incident reports from other organizations) as untrusted until proven otherwise, regardless of embedded metadata. The override parameter shifts the design tension from 'automatic and convenient' to 'explicit and documented' — but explicit only helps if the caller knows to use it, and documented only helps if that documentation reaches every automation script and integration in your environment.