> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Critical Vulnerability in OpenCTI (CVE-2025-24977) Allows Infrastructure Takeover via Webhook Abuse
- URL: https://darkwebinformer.com/critical-vulnerability-in-opencti-cve-2025-24977-allows-infrastructure-takeover-via-webhook-abuse/
- Published: 2025-05-05T17:46:36.000Z
- Updated: 2025-09-04T22:22:21.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities

🚨 **Critical Security Vulnerability**  
🆔 **CVE-2025-24977**  
💣 **CVSS Score:** 9.1 (Critical)  
📅 **Published:** 2025-05-05

---

🔹 **TL;DR**  
A critical vulnerability in **OpenCTI** versions prior to 6.4.11 allows users with the manage customizations capability to execute arbitrary commands on the host system via misuse of webhooks, potentially leading to full infrastructure compromise.

---

🔸 **Affected Versions**

- OpenCTI versions before 6.4.11

---

⚠️ **Vulnerability Details**  
OpenCTI is an open-source cyber threat intelligence platform. In versions prior to 6.4.11, users possessing the `manage customizations` capability can exploit webhooks to execute commands on the underlying infrastructure. This misuse can grant the attacker a root shell inside a container, exposing internal server-side secrets and potentially compromising the entire infrastructure.

---

🔧 **Recommended Action**

- Upgrade to OpenCTI version 6.4.11 or later immediately.
- Review user permissions, especially for the `manage customizations` capability, and restrict them to trusted individuals.
- Audit webhook configurations to ensure they are not susceptible to misuse.

---

👤 **Affected Environments**

- Organizations deploying OpenCTI versions prior to 6.4.11.
- Environments where users have been granted the `manage customizations` capability without strict oversight.

---

🛠 **References**

- [CVE Details](https://www.cvedetails.com/cve/CVE-2025-24977/)
- [GitHub Security Advisory](https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mf88-g2wq-p7qm)

---

🧠 **TTPs (MITRE Mapping)**

- T1059 – Command and Scripting Interpreter
- T1068 – Exploitation for Privilege Escalation
- T1210 – Exploitation of Remote Services