OpenCTI Denial-of-Service Vulnerability via Webhook Prototype Pollution

A denial-of-service vulnerability has been identified in OpenCTI versions prior to 6.5.2. The issue arises when users with the capability to manage customizations edit webhooks that execute JavaScript code. This functionality can be exploited to cause prototype pollution, leading to the Node.js server running the OpenCTI frontend becoming unavailable.

Impact

Exploitation of this vulnerability causes the Node.js server hosting the OpenCTI frontend to become unavailable, leading to a denial-of-service condition.

Remediation

Users can upgrade to OpenCTI version 6.5.2 or later to address this vulnerability.