CVE-2025-61782

Executive Summary

CVE-2025-61782 is an open redirect vulnerability in the OpenCTI platform, a widely used open-source platform for managing cyber threat intelligence (CTI) knowledge and observables. The flaw resides in the SAML authentication callback endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an unauthenticated attacker can force the server to issue a 302 redirect to any external URL. This enables phishing attacks, credential theft, and arbitrary site redirection, potentially compromising user trust and leading to further exploitation. The vulnerability has been patched in OpenCTI version 6.8.3. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using SAML-based authentication.

Supply Chain & Package Security

OpenCTI is a Python-based application distributed via Docker images and PyPI packages. The vulnerability affects the SAML authentication flow, which is a critical component for identity federation. Organizations using OpenCTI with SAML SSO should treat this as a high-priority supply chain risk, as an attacker could redirect users to malicious sites that mimic legitimate login pages, potentially harvesting credentials or session tokens.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – The victim must click a crafted link or be redirected via SAML flow.
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Potential credential exposure if redirected to a phishing page.
• Integrity Impact: Low (I:L) – Redirect can lead to malicious sites.
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the combination of low attack complexity and no required privileges makes it attractive for phishing campaigns. The requirement for user interaction slightly reduces the risk, but in a SAML SSO context, users may trust the redirect.

Deep Dive & Mechanics

The vulnerability exists in the SAML authentication callback handler. When a user initiates SAML-based login, the OpenCTI server processes the RelayState parameter from the SAML response. This parameter is intended to carry state information (e.g., the original URL the user wanted to access). However, the server does not properly validate or sanitize the RelayState value before using it in a redirect response.

Attack Flow:

1. An attacker crafts a malicious SAML authentication request with a RelayState parameter pointing to an external malicious URL (e.g., https://evil.com/phish).
2. The attacker sends this request to the OpenCTI SAML endpoint (/auth/saml/callback).
3. The OpenCTI server processes the SAML response and, without validation, issues a 302 redirect to the URL specified in RelayState.
4. The victim’s browser follows the redirect to the attacker-controlled site, which may host a phishing page mimicking the OpenCTI login.

Root Cause: Lack of validation on the RelayState parameter. The server should only allow redirects to internal or whitelisted URLs (e.g., relative paths or the same origin).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.8.3):

# In the SAML callback handler
relay_state = request.form.get('RelayState', '/')
# No validation - directly used for redirect
return redirect(relay_state)

Patched Code (6.8.3+):

# In the SAML callback handler
relay_state = request.form.get('RelayState', '/')
# Validate that the redirect target is internal
if not is_safe_url(relay_state):
    relay_state = '/'
return redirect(relay_state)

The patched version introduces a is_safe_url() function that checks if the URL is relative or points to the same origin, preventing open redirects.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a vulnerable OpenCTI instance (version < 6.8.3) with SAML authentication enabled.
• A publicly accessible server to host a phishing page.

Exploitation Steps:

1. Identify the SAML callback endpoint: https://target-opencti/auth/saml/callback
2. Craft a malicious SAML request with a RelayState parameter set to an external URL:

   POST /auth/saml/callback HTTP/1.1
   Host: target-opencti
   Content-Type: application/x-www-form-urlencoded
   
   SAMLResponse=<base64_encoded_saml>&RelayState=https://evil.com/phish
   

3. Send the request to the vulnerable server. The server will respond with a 302 redirect to https://evil.com/phish.
4. Host a phishing page on evil.com that mimics the OpenCTI login form to capture credentials.

Note: No public exploit code is available for this CVE.

Blue Team

Detection Steps:

1. Monitor logs for unusual RelayState values in SAML callback requests. Look for external URLs or IP addresses.
2. Check for 302 redirect responses from /auth/saml/callback to external domains.
3. Review SAML authentication logs for anomalies, such as requests from unexpected IPs or with malformed parameters.

Hunting Query (Splunk):

index=web_logs source="/auth/saml/callback" status=302
| eval relay_state = extract_param("RelayState")
| where match(relay_state, "^https?://")
| table _time, src_ip, relay_state, dest_url

Indicators of Compromise (IOCs)

• Network IOCs:
  • External URLs in RelayState parameter (e.g., https://evil.com/phish)
  • 302 redirect responses from /auth/saml/callback to external domains
• Log IOCs:
  • HTTP POST requests to /auth/saml/callback with RelayState containing external URLs
  • Unusual SAML responses from unknown identity providers
• File IOCs:
  • None specific to this vulnerability

Detection Engineering

YARA Rule

rule CVE_2025_61782_OpenCTI_Open_Redirect {
    meta:
        description = "Detects exploitation attempts of CVE-2025-61782 in OpenCTI SAML callback"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-61782"
    strings:
        $saml_callback = "/auth/saml/callback"
        $relay_state = "RelayState="
        $http_redirect = "HTTP/1.1 302"
    condition:
        $saml_callback and $relay_state and $http_redirect
}

Sigma Rule

title: OpenCTI SAML Open Redirect Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2025-61782 in OpenCTI SAML callback
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: opencti
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/auth/saml/callback'
        sc-status: 302
    filter:
        cs-uri-query|contains: 'RelayState='
    condition: selection and filter
falsepositives:
    - Legitimate SAML redirects to internal URLs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61782 OpenCTI SAML Open Redirect"; flow:to_server; content:"POST"; http_method; content:"/auth/saml/callback"; http_uri; content:"RelayState="; http_client_body; pcre:"/RelayState=https?:\/\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.8.3 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to /auth/saml/callback with RelayState containing external URLs.
3. Restrict SAML authentication to trusted identity providers only.

Long-Term Mitigations:

• Conduct a security review of all authentication endpoints for open redirect vulnerabilities.
• Implement strict URL validation for all redirect parameters.
• Enable logging and monitoring for SAML-related events.

Patch Details:

• Upgrade to OpenCTI version 6.8.3, which includes a fix that validates the RelayState parameter against a whitelist of allowed URLs.

Valters IT
Securing Digital Frontiers