CVE-2025-24977

The web-hook mechanism in OpenCTI lacks sufficient code injection protections (CWE-94), which allows a user with the `manage customizations` permission to embed a malicious payload. As a result of its execution, the attacker gains a root shell inside the container running the platform. Additionally, it is possible to read internal server secrets, such as API keys or authentication credentials. The obtained container access can serve as a starting point for further attacks on the environmental infrastructure (lateral movement).

An attacker can gain full control over the container hosting OpenCTI (root shell), read internal server secrets, and potentially extend the attack across the entire environmental infrastructure.

OpenCTI should be updated to version 6.4.11 or later, which contains a fix eliminating the described vulnerability. Before applying the patch, it is worth considering restricting the group of users with the `manage customizations` permission to trusted personnel only.

OpenCTI (Citeum) in all versions prior to 6.4.11