CVE-2025-61781

Executive Summary

CVE-2025-61781 is a critical authorization bypass vulnerability in OpenCTI, an open-source platform for managing cyber threat intelligence knowledge and observables. The flaw resides in the GraphQL mutation WorkspacePopoverDeletionMutation, which is designed to allow users to delete workspace-related objects such as dashboards and investigation cases. Due to a missing authorization check, an authenticated attacker can supply the UUID of any other user's workspace and delete it without owning it. This leads to unauthorized deletion of entire workspaces, causing data loss and service disruption. The vulnerability has a CVSS score of 7.1 (High) and is fixed in version 6.8.1.

Supply Chain & Package Security

OpenCTI is a Python-based application distributed via GitHub and Docker. The vulnerability is not in a dependency but in the application's own GraphQL API logic. However, organizations using OpenCTI should verify the integrity of their deployment and ensure they are not running a forked or modified version that may not include the fix. The official patch is available in the upstream repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs to know a valid workspace UUID.
• Privileges Required (PR): Low (L) - The attacker must be authenticated to the OpenCTI platform.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): Low (L) - The attacker can delete data but not modify it.
• Availability (A): High (H) - Deletion of workspaces causes significant service disruption and data loss.

Threat Level: High. The vulnerability is easy to exploit once authenticated, and the impact on availability is severe.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization (CWE-862). The GraphQL mutation WorkspacePopoverDeletionMutation is defined in the OpenCTI backend. When a user sends a mutation request, the API expects a workspace ID (UUID) as a parameter. The mutation then proceeds to delete the corresponding workspace object from the database.

The flaw is that the mutation does not check whether the authenticated user is the owner of the workspace. It only verifies that the user is authenticated (i.e., has a valid session token). An attacker can enumerate or guess UUIDs of other users' workspaces (UUIDs are often predictable or can be obtained through other means, such as shared dashboards or logs). Once a valid UUID is supplied, the mutation executes the deletion without any ownership validation.

The attack flow:

1. Attacker authenticates to OpenCTI (e.g., with low-privileged credentials).
2. Attacker obtains a target workspace UUID (e.g., via information disclosure, brute-force, or from a shared link).
3. Attacker sends a GraphQL mutation request to WorkspacePopoverDeletionMutation with the target UUID.
4. The server deletes the workspace and all associated data (dashboards, investigations, etc.).
5. The legitimate owner loses access to their workspace and data.

Vulnerable vs. Patched Code

Vulnerable Code (before 6.8.1):

# In the GraphQL resolver for WorkspacePopoverDeletionMutation
def resolve_delete_workspace(self, info, id):
    # No ownership check
    workspace = get_workspace_by_id(id)
    if workspace:
        delete_workspace(workspace)
        return {"success": True}
    return {"success": False}

Patched Code (6.8.1):

# In the GraphQL resolver for WorkspacePopoverDeletionMutation
def resolve_delete_workspace(self, info, id):
    user = get_current_user(info)
    workspace = get_workspace_by_id(id)
    if workspace and workspace.owner_id == user.id:
        delete_workspace(workspace)
        return {"success": True}
    return {"success": False}

The patch adds a check workspace.owner_id == user.id to ensure the requesting user is the owner of the workspace before deletion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenCTI instance (version < 6.8.1).
• Valid user credentials (any role).
• Knowledge of a target workspace UUID.

Exploitation Steps:

1. Obtain a valid session token (e.g., via login).
2. Identify a target workspace UUID. This can be done by:
   • Inspecting network traffic when a legitimate user views their workspace.
   • Using a shared dashboard link that contains the UUID.
   • Brute-forcing UUIDs (though this is noisy).
3. Send a GraphQL mutation request using a tool like curl or Burp Suite.

Example GraphQL Mutation:

mutation {
  WorkspacePopoverDeletionMutation(id: "TARGET_UUID") {
    success
  }
}

Curl Command:

curl -X POST https://target-opencti/graphql \
  -H "Authorization: Bearer YOUR_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation { WorkspacePopoverDeletionMutation(id: \"TARGET_UUID\") { success } }"}'

Expected Result: The workspace is deleted, and the response returns {"data":{"WorkspacePopoverDeletionMutation":{"success":true}}}.

Blue Team

Detection:

• Monitor GraphQL API logs for WorkspacePopoverDeletionMutation requests.
• Alert on deletion of workspaces by users who are not the owner.
• Track UUIDs being deleted and correlate with user activity.

Prevention:

• Immediately upgrade to OpenCTI version 6.8.1 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block mutation requests that do not include a valid ownership token.
• Restrict API access to trusted IPs and enforce strict session management.

Hunting:

• Search for logs where WorkspacePopoverDeletionMutation is called with a UUID that does not belong to the requesting user.
• Look for patterns of rapid deletion requests (potential brute-force of UUIDs).

Indicators of Compromise (IOCs)

• Network: GraphQL requests to /graphql with mutation WorkspacePopoverDeletionMutation and a UUID parameter.
• Logs: API access logs showing deletion of workspaces by users who are not the owner.
• System: Missing workspace data, dashboards, or investigation cases that were previously present.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule detect_opencti_workspace_deletion_exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-61781 in OpenCTI logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61781"
    strings:
        $mutation = "WorkspacePopoverDeletionMutation"
        $uuid_pattern = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/
    condition:
        $mutation and #uuid_pattern > 0
}

Sigma Rule

title: OpenCTI Unauthorized Workspace Deletion Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-61781 by monitoring GraphQL mutation requests for WorkspacePopoverDeletionMutation
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: opencti
detection:
    selection:
        event: "graphql_request"
        mutation: "WorkspacePopoverDeletionMutation"
    condition: selection
falsepositives:
    - Legitimate workspace deletion by the owner
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-61781 OpenCTI Unauthorized Workspace Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/graphql"; http_uri;
    content:"WorkspacePopoverDeletionMutation"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-61781;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.8.1 or later. This is the only complete fix.
2. If upgrade is not possible, disable the WorkspacePopoverDeletionMutation mutation by modifying the GraphQL schema or using a reverse proxy to block the specific mutation.
3. Review user permissions and ensure that only trusted users have access to the platform.
4. Enable audit logging for all GraphQL mutations and monitor for suspicious deletion activity.

Long-term Measures:

• Implement a least-privilege model for API access.
• Regularly audit user accounts and remove inactive or unnecessary users.
• Use Web Application Firewall (WAF) rules to block unauthorized mutation requests.
• Backup workspaces regularly to recover from accidental or malicious deletions.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.