Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

opencti-platform/opencti

              master @ 8cb4305
            

Fixes

CVEs

CRITICAL

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 44 prior fixes. Scrutinize any change in this area.

opencti-platform/opencti-graphql/src/domain/user.js: most-fixed (10 issues). Treat as high-risk during review.

64 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple high/critical auth bypasses in user management (JWT verification, email normalization, password updates, org-admin scoping) indicate a systemic weakness in user-related authorization and identity handling.

Server-Side Template Injection: Critical SSTI and sandbox escape vulnerabilities in EJS template rendering allow remote code execution; multiple fixes were needed to harden the sandbox, indicating a high-risk, complex attack surface.

SSRF: SSRF via attacker-controlled URLs in ingestion and webhooks requires URI re-validation after variable substitution and redirect deny-listing; the risk is internal network access.