Summary
The OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to inject arbitrary Elasticsearch Painless scripts into search queries. The user-supplied script value is passed directly to Elasticsearch without any validation or sanitization.
Impact
Denial of Service: An attacker can inject computationally expensive Painless scripts (e.g., infinite loops bounded only by Elasticsearch's script timeout) that consume cluster CPU resources, degrading or denying service for all users.
romain-deperne Reporter
Summary
The OpenCTI GraphQL API exposes a
scriptfilter operator in itsFilterOperatorenum that allows any authenticated user with theKNOWLEDGEcapability to inject arbitrary Elasticsearch Painless scripts into search queries. The user-supplied script value is passed directly to Elasticsearch without any validation or sanitization.Impact
Denial of Service: An attacker can inject computationally expensive Painless scripts (e.g., infinite loops bounded only by Elasticsearch's script timeout) that consume cluster CPU resources, degrading or denying service for all users.