CyberRota Analysis
AI-GeneratedThe JSON ingestion mapper in OpenCTI versions prior to 7.260706.0 is vulnerable to a denial-of-service attack due to unvalidated complexity in user-supplied regular expressions, allowing authenticated users to create patterns that can block the Node.js event loop and render the GraphQL API unavailable. This vulnerability primarily impacts the availability of the service rather than data integrity or confidentiality. Organizations using OpenCTI for threat intelligence management should prioritize upgrading to version 7.260706.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in opencti-platform/opencti-graphql/src/parser/json-mapper.ts without validating its complexity. An authenticated user with JSON mapper creation permission could provide a catastrophically backtracking pattern and matching ingestion input, blocking the Node.js event loop and making the GraphQL API unavailable to all users. Scheduled ingestion could repeatedly execute the malicious mapper without additional attacker action, and recovery could require disabling the mapper and restarting the process. The issue affects availability and does not expose or modify data. This issue is fixed in version 7.260706.0.