CVE-2025-24977

The impact of CVE-2025-24977 is severe. A successful exploit allows an attacker to gain a root shell within the OpenCTI container, effectively granting them complete control over the underlying infrastructure. This includes the ability to read and modify sensitive data, install malware, and potentially pivot to other systems within the network. The exposure of internal server-side secrets further amplifies the risk, potentially providing credentials or configuration details that can be leveraged for broader attacks. This vulnerability resembles scenarios where container escape vulnerabilities are exploited to compromise the host system.

Organizations utilizing OpenCTI for threat intelligence management are at risk, particularly those with lax access controls or shared hosting environments. Deployment patterns where multiple users have elevated privileges within OpenCTI increase the potential attack surface. Legacy OpenCTI installations that have not been regularly patched are also particularly vulnerable.

• python: Monitor OpenCTI logs for unusual command execution attempts, particularly those originating from webhook requests.

# Example: Check for suspicious commands in OpenCTI logs
import re
with open('opencti.log', 'r') as f:
    for line in f:
        if re.search(r'command:.*(rm -rf|wget|curl)', line):
            print(f'Suspicious command detected: {line}')

• linux / server: Use journalctl to filter for errors or warnings related to OpenCTI's webhook processing.

journalctl -u opencti -f --grep 'webhook' --grep 'error'

• generic web: Monitor access logs for unusual patterns of requests to OpenCTI webhook endpoints. Look for requests with unexpected parameters or payloads.

1. 2025-05-05Disclosure

   disclosure

1. 予約済み2025-01-29
2. 公開日2025-05-05
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-24977 is to immediately upgrade OpenCTI to version 6.4.11 or later. If upgrading is not immediately feasible, restrict access to the 'manage customizations' capability to only trusted users. Consider implementing network segmentation to limit the potential blast radius of a successful exploit. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block suspicious command execution attempts. After upgrading, verify the fix by attempting to execute a command via the webhooks functionality with a user lacking elevated privileges; the command should be rejected.