CVE-2025-26621

Executive Summary

CVE-2025-26621 is a high-severity vulnerability in OpenCTI, an open-source platform for managing cyber threat intelligence knowledge and observables. The flaw allows any user with the capability to manage customizations to edit a webhook that will execute JavaScript code. This can be abused to cause a denial of service (DoS) attack via prototype pollution, making the Node.js server running the OpenCTI frontend become unavailable. The vulnerability affects versions prior to 6.5.2. The CVSS score is 7.6, indicating a high severity. The EPSS score is 0.0%, suggesting low exploitation likelihood in the wild at the time of analysis. No public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

OpenCTI is a Node.js application. The vulnerability is introduced through the application's own codebase, not through a third-party package. However, the prototype pollution attack vector is a common JavaScript/Node.js security issue. Organizations using OpenCTI should ensure they are running version 6.5.2 or later, which contains the fix.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack can be carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for the attack.
• Privileges Required (PR): High (H) - The attacker must have the "manage customizations" capability.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None (N) - No impact on confidentiality.
• Integrity (I): None (N) - No impact on integrity.
• Availability (A): High (H) - The attack can cause a complete denial of service.

Threat Level: High. While the attack requires high privileges, the impact on availability is severe, potentially taking the entire OpenCTI frontend offline.

Deep Dive & Mechanics

The vulnerability resides in the webhook editing functionality of OpenCTI. A user with the "manage customizations" capability can create or edit webhooks. The webhook configuration likely includes a field for a URL or a callback that is processed by the Node.js server. The flaw allows the injection of JavaScript code into this field, which is then executed by the server.

The specific attack vector is prototype pollution. In JavaScript, objects have a prototype chain. By manipulating the __proto__ property of an object, an attacker can inject properties into the global object prototype. This can lead to unexpected behavior, including denial of service. For example, by polluting the prototype with a property that causes an infinite loop or a crash when accessed, the attacker can make the Node.js server unresponsive.

The attack flow:

1. An authenticated user with "manage customizations" privileges navigates to the webhook configuration page.
2. The user creates or edits a webhook, injecting a malicious payload into a field (e.g., the URL or a custom header).
3. The payload contains JavaScript code that pollutes the prototype, e.g., {"__proto__": {"polluted": "true"}}.
4. When the server processes the webhook configuration (e.g., by iterating over its properties), the polluted prototype causes a denial of service.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the fix likely involves sanitizing or validating the input fields of webhook configurations to prevent prototype pollution. This could include:

• Using Object.create(null) to create objects without a prototype.
• Validating that keys like __proto__, constructor, and prototype are not allowed.
• Using a library like lodash's set function with proper protection.

Vulnerable Code (Conceptual):

// Vulnerable: Directly assigns user input to an object
function createWebhook(config) {
  let webhook = {};
  for (let key in config) {
    webhook[key] = config[key]; // Prototype pollution possible
  }
  return webhook;
}

Patched Code (Conceptual):

// Patched: Uses Object.create(null) and sanitizes keys
function createWebhook(config) {
  let webhook = Object.create(null);
  for (let key in config) {
    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
      continue; // Reject dangerous keys
    }
    webhook[key] = config[key];
  }
  return webhook;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenCTI instance (version < 6.5.2).
• A user account with the "manage customizations" capability.

Steps:

1. Log in to the OpenCTI frontend.
2. Navigate to the webhook configuration section (e.g., Settings > Customizations > Webhooks).
3. Create a new webhook or edit an existing one.
4. In a field that is processed by the server (e.g., the URL field), inject a prototype pollution payload. For example:

   {
     "url": "http://example.com",
     "__proto__": {
       "polluted": "true"
     }
   }
   

5. Save the webhook configuration.
6. The server will process the configuration, pollute the prototype, and likely crash or become unresponsive.

Note: Since no public PoC is available, this is a theoretical exploitation scenario. The exact field and payload may vary.

Blue Team

Detection:

• Monitor for unusual webhook creation or modification events.
• Look for payloads containing __proto__, constructor, or prototype in webhook configuration fields.
• Monitor server logs for crashes or unhandled exceptions related to object manipulation.

Prevention:

• Upgrade to OpenCTI version 6.5.2 or later.
• Restrict the "manage customizations" capability to trusted users only.
• Implement input validation and sanitization for all user-supplied data.

Indicators of Compromise (IOCs)

• Network: HTTP requests to the OpenCTI API endpoint for webhook creation/modification (e.g., /api/webhooks) containing JSON payloads with __proto__ keys.
• Logs: Server logs showing errors like TypeError: Cannot set property 'polluted' of undefined or similar prototype pollution errors.
• System: Unresponsive OpenCTI frontend service.

Detection Engineering

YARA Rule

rule CVE_2025_26621_Prototype_Pollution {
  meta:
    description = "Detects prototype pollution attempts in OpenCTI webhook configurations"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-26621"
  strings:
    $proto1 = "__proto__"
    $proto2 = "constructor"
    $proto3 = "prototype"
  condition:
    any of ($proto*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-26621 - OpenCTI Webhook Prototype Pollution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit prototype pollution in OpenCTI webhook configurations
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: opencti
detection:
  selection:
    EventID: 4663
    ObjectName: '/api/webhooks'
    AccessMask: 'WRITE_DAC'
  condition: selection
falsepositives:
  - Legitimate webhook configuration changes by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26621 - OpenCTI Webhook Prototype Pollution Attempt"; flow:to_server; content:"/api/webhooks"; http_uri; content:"__proto__"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade OpenCTI to version 6.5.2 or later.
• If upgrade is not possible, restrict the "manage customizations" capability to a minimal set of trusted users.

Long-term:

• Implement input validation and sanitization for all user-supplied data, especially in configuration fields.
• Use Object.create(null) for objects that store user data.
• Regularly review and audit user permissions.

Workaround:

• Disable the webhook functionality if not needed.
• Use a web application firewall (WAF) to block requests containing __proto__ in JSON payloads.

Valters IT