CVE-2024-37155 OpenCTI May Bypass Introspection Restriction
Attackers can bypass GraphQL introspection restrictions in OpenCTI to gather sensitive endpoint information or launch denial-of-service attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37155?
CVE-2024-37155 is a medium-severity vulnerability in OpenCTI-Platform opencti, published on 18 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. GraphQL Queries in OpenCTI can be validated using the `secureIntrospectionPlugin`. The regex check in the plkugin can be bypassed by removing the carriage return and line feed characters (`\r\n`). Running a curl command against a local instance of OpenCTI will result in a limited error message. By running the same Introspection query without the `\r\n` characters, the unauthenticated user is able to successfully run a full Introspection query. Bypassing this restriction allows the attacker to gather a wealth of information about the GraphQL endpoint functionality that can be used to perform actions and/or read data without authorization. These queries can also be weaponized to conduct a Denial of Service (DoS) attack if sent repeatedly. Users should upgrade to version 6.1.9 to receive a patch for the issue.
Weakness: CWE-284
Which versions are affected by CVE-2024-37155?
3 open source packages ship an affected version, including pycti. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pycti PyPI | All versions | 6.1.9 |
pycti PyPI | All versions | 6.1.9 |
pycti PyPI | All versions | 6.1.9 |
Products include Citeum Opencti.
How do I fix CVE-2024-37155?
Upgrade pycti to 6.1.9 or later.
Is CVE-2024-37155 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37155 exists.
Other vulnerabilities in OpenCTI-Platform opencti
- CVE-2026-27960 OpenCTI privilege escalation and unauthenticated access via default admin account
- CVE-2026-39980 OpenCTI affected by RCE via notifier template
- CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook
- CVE-2024-26139 OpenCTI Authenticated Privilege Escalation
- CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing
Sources
Also known as GHSA-4mvw-j8r9-xcgc, PYSEC-2024-313.