CVE-2025-24887 in OpenCTI
Summary
by MITRE • 04/30/2025
OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the `external` flag on/off and change the own token value for a user. It is also possible to edit attributes that are not in the allow list, such as `otp_qr` and `otp_activated`. If external users exist in the OpenCTI setup and the information about these users identities is sensitive, the above vulnerabilities can be used to enumerate existing user accounts as a standard low privileged user. This issue has been patched in version 6.4.10.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/19/2025
The vulnerability described in CVE-2025-24887 represents a critical access control flaw within the OpenCTI cyber threat intelligence platform that affects versions 6.4.8 through 6.4.9. This issue stems from inadequate validation of user permissions and attribute restrictions within the platform's authorization framework, creating a scenario where standard users can bypass intended security controls. The vulnerability specifically targets the platform's allow/deny list mechanisms that are designed to restrict user modifications to sensitive attributes, fundamentally undermining the principle of least privilege that is essential for secure multi-user environments.
The technical exploitation of this vulnerability manifests through the ability of low-privileged users to manipulate critical user account attributes that should remain immutable. Attackers can toggle the external flag on and off, which allows them to potentially escalate their access privileges or manipulate user classification within the system. Additionally, the vulnerability permits modification of the user's own token value, which could enable session hijacking or privilege escalation attacks. The flaw extends beyond simple flag manipulation to include editing attributes not explicitly listed in allow lists such as otp_qr and otp_activated fields, demonstrating a complete breakdown in attribute-level access control enforcement.
The operational impact of this vulnerability is particularly severe for organizations utilizing OpenCTI with external user accounts containing sensitive identity information. Low-privileged attackers can leverage this vulnerability to enumerate existing user accounts within the system, effectively bypassing the intended security boundaries that separate internal and external users. This enumeration capability provides attackers with valuable reconnaissance data that can be used for further targeting, credential stuffing attacks, or social engineering initiatives. The vulnerability essentially transforms the access control model from a controlled environment where user attributes are protected to a scenario where unauthorized modifications can be made to user profiles, potentially leading to complete account compromise or unauthorized access to sensitive threat intelligence data.
This vulnerability aligns with CWE-693, which addresses protection mechanism failures in software systems, and represents a clear violation of the principle of least privilege as outlined in the MITRE ATT&CK framework's privilege escalation techniques. The bypass of allow/deny lists specifically corresponds to techniques described in ATT&CK's T1078 - Valid Accounts and T1548.001 - Abuse Elevation Control Mechanisms. Organizations should immediately implement the patch available in OpenCTI version 6.4.10, which addresses the underlying authorization logic that permits these unauthorized modifications. Additionally, security teams should conduct thorough audits of user permissions and attribute configurations to identify any potential exploitation that may have occurred prior to patching, while implementing monitoring for suspicious attribute modification patterns that could indicate ongoing exploitation attempts.