Horizon Alert
Summary of the vulnerability and why it matters
An unauthenticated privilege escalation vulnerability in OpenCTI allows attackers to query the API as any user, including the default administrator. This could lead to unauthorized access and control of sensitive cyber threat intelligence data.
- Attackers can impersonate users.
- Sensitive intelligence data is at risk.
- Affects systems reachable from the internet.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could exploit this flaw by directly interacting with the OpenCTI API to impersonate any existing user. This allows them to gain elevated privileges, potentially including access to the default administrator account.
- Target the API endpoint.
- No authentication required.
- Access as any user.
Live Threat
Current exploitation, exposure, and threat context
This privilege escalation vulnerability in OpenCTI allows unauthenticated attackers to impersonate any user via the API. Given its Critical severity and broad impact, attackers will likely find this attractive for initial access or lateral movement, especially given the lack of authentication requirements. While not yet listed as a KEV, the ease of exploitation and potential for significant compromise makes it a notable threat.
- Affects API-driven web platforms.
- Exploitable by unauthenticated attackers.
- No KEV listing, but high impact.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching OpenCTI to version 6.9.13 or higher immediately, as this critical vulnerability allows unauthenticated attackers to escalate privileges to the administrator level. If immediate patching is not feasible, implement the provided workaround to disable external management of the default admin account.
- Upgrade to OpenCTI 6.9.13.
- Disable default admin via configuration.
- Monitor API logs for suspicious queries.
