Cacti vulnerable to command injection attack through URL manipulation

CVE-2024-29895

What is CVE-2024-29895?

CVE-2024-29895 is a critical vulnerability affecting the Cacti software, which is an open-source network monitoring and management tool. This vulnerability allows unauthenticated users to exploit a command injection flaw, particularly when the register_argc_argv PHP option is enabled. By manipulating URLs, attackers can execute arbitrary commands on the server, posing a serious risk to organizations that rely on Cacti for operational monitoring. The default configuration of PHP in many environments, including popular Docker images, makes this vulnerability particularly concerning for users.

Technical Details

The vulnerability primarily resides in the cmd_realtime.php file within the Cacti application. Specifically, it involves the use of the $poller_id variable, which is derived from $_SERVER['argv']. Under certain conditions, such as when the register_argc_argv PHP option is enabled, an attacker can manipulate requests to execute malicious commands on the server. This situation is exacerbated by the fact that this option is typically turned on by default in many PHP installations, which increases the likelihood of exploitation in real-world environments.

Impact of the Vulnerability

1. Unauthorized Command Execution: Attackers can execute arbitrary commands on the server without authentication, leading to unauthorized access and control over the system.

2. Potential for Data Breaches: Given the elevated privileges granted through command execution, attackers may access sensitive data, potentially leading to significant breaches of confidentiality.

3. Risk of Malware Deployment: The ability to run arbitrary commands can enable attackers to deploy malware or ransomware on the compromised server, compromising not just the initial system but potentially spreading to connected networks or devices.

News Articles

meterpreter.org

CVE-2024-29895

Cacti Patches Critical Flaws: Urgent Update Needed for Network Security

CVE-2024-29895 (CVSS score 10.0): A command injection vulnerability that allows any unauthenticated user to execute arbitrary commands

References