{"id":"CVE-2024-37155","title":"OpenCTI May Bypass Introspection Restriction","summary":"OpenCTI May Bypass Introspection Restriction","severity":"medium","cvss":6.5,"cwe":["CWE-284"],"vendor":"pycti","product":"pycti","ecosystem":"pip","affected":["pycti < 6.1.9"],"patched":["pycti 6.1.9"],"published":"2026-06-22","updated":"2026-06-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4mvw-j8r9-xcgc","references":[{"url":"https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-4mvw-j8r9-xcgc"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37155"},{"url":"https://github.com/OpenCTI-Platform/opencti/commit/f87d96918c63b0c3d3ebfbea6c789d48e2f56ad5"},{"url":"https://github.com/OpenCTI-Platform/opencti/blob/6343b82b0b0a5d3ded3b30d08ce282328a556268/opencti-platform/opencti-graphql/src/graphql/graphql.js#L83-L94"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pycti/PYSEC-2024-313.yaml"},{"url":"https://github.com/advisories/GHSA-4mvw-j8r9-xcgc"}],"tags":["ghsa","pip"],"epss":0.00464,"epssPercentile":0.39327,"ingestedAt":"2026-06-29T13:24:35.673Z","slug":"CVE-2024-37155","body":"## Overview\n\n### Summary\n\nThe regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query.\n\n### Details\n\nGraphQL Queries in OpenCTI can be validated using the `secureIntrospectionPlugin`.\n\n### Impact\nBypassing this restriction allows the attacker to gather a wealth of information about the GraphQL endpoint functionality that can be used to perform actions and/or read data without authorization.  These queries can also be weaponized to conduct a Denial of Service (DoS) attack if sent repeatedly.\n\n## Affected packages\n\n- `pycti < 6.1.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pycti 6.1.9`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}