CVE-2024-45805

Executive Summary

CVE-2024-45805 is an Inadequate Access Control vulnerability in the OpenCTI platform, an open-source cyber threat intelligence (CTI) platform. The flaw allows authenticated general users to access support information (specifically ZIP archives) that should be restricted to administrators and support personnel. The vulnerability arises because the access control for the /storage/get/support/UUID/UUID.zip endpoint is insufficient, and the UUID required to access these files can be enumerated by general users via the logs query functionality. This leads to unauthorized disclosure of potentially sensitive support data. The CVSS score is 4.3 (Medium), and the vulnerability is fixed in OpenCTI version 6.3.0.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a valid general user account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited disclosure of support-related data.
• Integrity (I): None (N) - No data integrity impact.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the exposure of support information could contain internal system details, configuration data, or other sensitive information that could aid further attacks.

Deep Dive & Mechanics

The vulnerability is rooted in two key weaknesses:

1. Inadequate Access Control on Support Endpoint: The endpoint /storage/get/support/UUID/UUID.zip is designed to serve support-related ZIP archives. However, it does not properly enforce authorization checks to ensure that only users with SETTINGS_SUPPORT privileges (admin/support) can access it. Any authenticated user can directly request a file if they know the UUID.

2. UUID Leakage via Logs Query: The UUIDs for these support archives are not secret. A general user can execute a logs query (likely via the platform's search or logging interface) that reveals the UUIDs of support archives. This allows an attacker to enumerate valid UUIDs and then directly access the corresponding ZIP files.

The attack flow is:

1. Authenticate as a general user.
2. Use the logs query functionality to obtain a UUID for a support archive.
3. Send a GET request to /storage/get/support/<UUID>/<UUID>.zip.
4. Download the ZIP file containing support information.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.3.0): The vulnerable code likely resides in the controller or service handling the /storage/get/support/ route. It would check for authentication but not for specific authorization (e.g., checking if the user has the SETTINGS_SUPPORT permission).

# Vulnerable example (pseudo-code)
@app.route('/storage/get/support/<uuid>/<filename>')
def get_support_file(uuid, filename):
    if not current_user.is_authenticated:
        abort(401)
    # Missing authorization check for SETTINGS_SUPPORT
    file_path = get_support_file_path(uuid, filename)
    return send_file(file_path)

Patched Code (6.3.0+): The patched code adds an explicit authorization check to ensure the user has the required SETTINGS_SUPPORT permission before serving the file.

# Patched example (pseudo-code)
@app.route('/storage/get/support/<uuid>/<filename>')
def get_support_file(uuid, filename):
    if not current_user.is_authenticated:
        abort(401)
    if not current_user.has_permission('SETTINGS_SUPPORT'):
        abort(403)
    file_path = get_support_file_path(uuid, filename)
    return send_file(file_path)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on an OpenCTI instance (version < 6.3.0).
• Network access to the OpenCTI web interface.

Steps:

1. Authenticate: Log in to the OpenCTI platform with the general user credentials.

2. Enumerate UUIDs: Use the logs query functionality to find support archive UUIDs. This might involve sending a specific GraphQL query or accessing a log endpoint. Example using curl (assuming a GraphQL API):

   curl -X POST https://<opencti-domain>/graphql \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"query": "query { logs { edges { node { ... on SupportLog { uuid } } } } }"}'
   

3. Download Support Archive: Once a UUID is obtained, download the ZIP file:

   curl -O https://<opencti-domain>/storage/get/support/<UUID>/<UUID>.zip \
     -H "Authorization: Bearer <token>"
   

4. Extract and Analyze: Unzip the file and review its contents for sensitive information (e.g., configuration files, internal notes, system details).

Blue Team (Detection & Defense)

Detection:

• Monitor access logs for requests to /storage/get/support/ from users who do not have the SETTINGS_SUPPORT role.
• Alert on unusual patterns of logs queries that retrieve UUIDs, especially from non-admin users.
• Use the Sigma rule provided in the Detection Engineering section.

Defense:

• Immediate: Upgrade to OpenCTI version 6.3.0 or later.
• Workaround (if patching is delayed):
  • Implement a Web Application Firewall (WAF) rule to block access to /storage/get/support/ for non-admin users.
  • Restrict the logs query functionality to only users with appropriate privileges.
  • Monitor and audit access to the support endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /storage/get/support/<UUID>/<UUID>.zip from non-admin users.
  • GraphQL queries containing SupportLog or similar terms from non-admin users.
• File IOCs:
  • ZIP files downloaded from the /storage/get/support/ endpoint.
• Log IOCs:
  • Access logs showing 200 OK responses for /storage/get/support/ requests from users without SETTINGS_SUPPORT role.

Detection Engineering

YARA Rule

rule Detect_OpenCTI_Support_Archive_Access {
    meta:
        description = "Detects access to OpenCTI support archive endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45805"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "/storage/get/support/" ascii wide nocase
    condition:
        $s1
}

Sigma Rule

title: OpenCTI Support Archive Unauthorized Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to OpenCTI support archive endpoint by non-admin users
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45805
logsource:
    category: webserver
    product: opencti
detection:
    selection:
        cs-uri-stem:
            - "/storage/get/support/*"
        cs-username:
            - "*"
    filter:
        cs-username:
            - "admin"
            - "support"
    condition: selection and not filter
falsepositives:
    - Legitimate admin/support users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45805 OpenCTI Support Archive Access"; flow:to_server,established; content:"/storage/get/support/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Primary Remediation:

• Upgrade OpenCTI: Immediately upgrade to version 6.3.0 or later. This is the only complete fix.

Mitigation Steps (if immediate upgrade is not possible):

1. Restrict Access: Use a reverse proxy or WAF to block access to the /storage/get/support/ endpoint for all users except those with administrative privileges.
2. Disable Logs Query for General Users: If possible, restrict the logs query functionality to only users with the SETTINGS_SUPPORT role.
3. Monitor and Audit: Enable detailed logging for the /storage/get/support/ endpoint and regularly audit access logs for suspicious activity.
4. Review User Permissions: Ensure that only necessary users have accounts on the platform and that permissions are set to the principle of least privilege.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert