The cisco_firesight_manager_ACL_rule_export module in misp-modules constructs a shell script by interpolating configuration and MISP attribute values directly into single-quoted shell string assignments without escaping or sanitization. If an attacker submits MISP attributes containing single-quote characters, they can break out of the quoting context and inject arbitrary shell commands into the exported script. When a security analyst executes this script, the injected commands run with their privileges, potentially compromising credentials, modifying ACL rules, or the analyst's workstation. A secondary issue is a NameError caused by referencing an unassigned variable 'config' when the request payload lacks a 'config' key, resulting in denial of service. Exploitation requires the ability to submit MISP events or attributes and the victim executing the exported script. No authentication bypass beyond standard MISP submission privileges is needed.

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the security analyst who runs the exported script. This can lead to exposure of Cisco fireSIGHT Manager credentials, unauthorized modification of ACL rules, or compromise of the analyst's workstation. The secondary defect can cause a denial of service by triggering a NameError when the 'config' key is missing in the request payload.

No official patch or remediation is currently confirmed. Users should avoid executing exported shell scripts generated by the vulnerable module without first reviewing and sanitizing their contents. Restrict MISP event and attribute submission privileges to trusted users to reduce the risk of malicious input. Monitor vendor advisories for updates or patches addressing this vulnerability.