CVE-2024-29895 in Cacti
Summary
by MITRE • 05/14/2024
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/14/2024
The vulnerability CVE-2024-29895 affects Cacti, a widely-used operational monitoring and fault management framework that provides network monitoring capabilities for IT infrastructure. This command injection flaw exists in the 1.3.x development branch and represents a critical security weakness that can be exploited by unauthenticated attackers to execute arbitrary commands on affected servers. The vulnerability specifically targets the cmd_realtime.php component where command execution occurs, making it particularly dangerous for systems that rely on Cacti for network monitoring and data collection.
The technical flaw stems from improper input validation and sanitization within the command execution flow. At line 119 of cmd_realtime.php, the system directly incorporates the $poller_id variable into command execution without adequate sanitization. This $poller_id variable is sourced from $_SERVER['argv'], which represents the command line arguments passed to the PHP script. When the PHP configuration option register_argc_argv is enabled, these arguments can be manipulated through URL parameters, creating an attack vector that allows remote command injection. This configuration is enabled by default in many common environments including the official PHP Docker images, which significantly increases the attack surface and exploitability of this vulnerability.
The operational impact of this vulnerability is severe and far-reaching for organizations using Cacti monitoring systems. An unauthenticated attacker can leverage this vulnerability to execute arbitrary commands with the privileges of the web server process, potentially leading to complete system compromise. The vulnerability allows attackers to perform reconnaissance, escalate privileges, install backdoors, or exfiltrate sensitive data from the monitored network infrastructure. Given that Cacti is commonly deployed in production environments where it has access to critical network monitoring data and system information, the potential damage extends beyond simple command execution to include full system infiltration and data breach scenarios.
The vulnerability demonstrates a classic command injection weakness that aligns with CWE-77 and follows patterns identified in the ATT&CK framework under T1059.001 for Command and Scripting Interpreter. The flaw represents a failure in input validation and proper parameter handling, where user-controllable data is directly incorporated into system commands without proper sanitization. Organizations should immediately implement mitigations including disabling the register_argc_argv PHP option, applying the available patch from commit 53e8014d1f082034e0646edc6286cde3800c683d, and implementing network segmentation to limit access to Cacti interfaces. Additionally, monitoring for unusual command execution patterns and implementing proper access controls around the affected components can help detect and prevent exploitation attempts. The fact that the initial patch was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc indicates a potential regression in the software's security posture that requires careful attention during the remediation process.