OpenCTI stream syncer missing URI validation: fix with wildcard deny list (PR #16656)

Key Vulnerability Information Summary Vulnerability Overview Type: Missing URI validation in the stream synchronizer Issue: The stream synchronizer does not validate the field during creation and editing, which may allow untrusted or internal domains to be used as sync sources Remediation Goal: Enforce a configurable URI deny list for the stream synchronizer, aligning with the validation behavior of the ingestion module Scope of Impact Affected Component: The stream synchronizer in Affected Operations: Synchronizer creation (create) and editing (edit) workflows Configuration Options: (JSON configuration) or the environment variable Fix Approach Execute validation on the field during synchronizer creation and editing Validation logic: Match the against the deny list; if a match is found, the URI is rejected Supports wildcard matching (e.g., matches , , and ) Upon validation failure, display an error message in the UI via the callback PoC / Exploitation Code 1. Configure URI deny list (JSON) 2. Configure URI deny list (environment variable) 3. GraphQL Edit Synchronizer (mutation) Expected behavior: When the matches the deny list, the mutation is rejected, and the message is displayed. 4. Test Cases (Key Scenarios) Create synchronizer + denied URI → request is rejected, error displayed in UI Create synchronizer + allowed URI → created successfully Edit synchronizer + denied URI → mutation is rejected Edit synchronizer + allowed URI → updated successfully Wildcard matching: blocks , , and Related PR PR Number: #16617 Title: Status: Merged Branch: → Commit:

Goal Reached Thanks to every supporter — we hit 100%!

OpenCTI stream syncer missing URI validation: fix with wildcard deny list (PR #16656)

More from this source