Vulnerability · Published May 5, 2025 · Assigned by GitHub_M
CVE-2025-24977OpenCTI has remote code execution and sensitive secrets exposed through web hook
Critical 9.1
In plain English
A critical-severity code injection in opencti from OpenCTI-Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the malicious user gets a root shell inside a container this opens up the the infrastructure environment for further attacks and exposures. Version 6.4.11 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pycti | 6.4.11 | PYSEC-2025-179 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenCTI-Platform | opencti | < 6.4.11 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H