OpenCTI JSON Mapper safeEjs Sandbox Escape RCE

Description

OpenCTI is an open source cyber threat intelligence platform built as a Node.js GraphQL application. Its data-mapping feature lets a user attach an EJS "formula" to a JSON mapper attribute, which the backend renders through a home-grown sandbox (safeEjs) that is intended to allow only arithmetic and property access over the mapped data.

The sandbox verifier permits assignment to identifiers it merely allow-lists, such as the String global. Because the generated EJS runs in sloppy mode inside a `with(locals)` block, that assignment reaches the global object, and the sandbox's own runtime property guard then calls the now-attacker-controlled String() when it normalises property names. Poisoning String defeats the guard's constructor deny-list, and `({})['constructor']['constructor']` yields Function, giving arbitrary JavaScript execution in the OpenCTI API process. The formula is rendered synchronously in the main process rather than in the isolated worker used by the other render sites, so execution lands in the process that holds the platform's Elasticsearch, object-store and message-queue clients.

The jsonMapperTest GraphQL mutation reaches this render path and requires only the CSVMAPPERS ("Manage data mappers") capability. The GraphQL endpoint is authenticated, so the module offers three ways to obtain a context that satisfies it. AUTH_MODE=password logs in with USERNAME and PASSWORD through the public `token` mutation and reuses the resulting opencti_session cookie, optionally completing 2FA with OTP_CODE. AUTH_MODE=token sends a pre-existing OpenCTI API token as a bearer credential. When a target has the header-based authentication strategy enabled without a proxy-source restriction, AUTH_MODE=header obtains a session for an arbitrary user (for example the platform administrator) with no credential at all.