Description
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.
EPSS Score:
87%
Comprehensive Technical Analysis of EUVD-2024-22957
1. Vulnerability Assessment and Severity Evaluation
Vulnerability Description:
The vulnerability in Cacti, an operational monitoring and fault management framework, allows authenticated users with "Import Templates" permission to execute arbitrary PHP code on the web server. This is due to an arbitrary file write vulnerability in the "Package Import" feature, specifically within the import_package() function in the /lib/import.php script. The function does not properly validate the filename and file content provided within the XML data, leading to potential path traversal and arbitrary file write operations.
Severity Evaluation:
The vulnerability has a CVSS Base Score of 9.1, which is considered critical. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H indicates the following:
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): High (H)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
The high severity is due to the potential for complete system compromise, including the execution of arbitrary PHP code, which can lead to data breaches, unauthorized access, and system downtime.
2. Potential Attack Vectors and Exploitation Methods
Attack Vectors:
- Authenticated Users: An attacker with valid credentials and "Import Templates" permission can exploit this vulnerability.
- Network Access: The attack can be conducted remotely over the network.
Exploitation Methods:
- Arbitrary File Write: The attacker can craft a malicious XML file with specific filenames and content to write or overwrite files on the web server.
- Path Traversal: By including path traversal sequences (e.g.,
../), the attacker can write files outside the intended directory, potentially affecting critical system files. - PHP Code Execution: The attacker can inject PHP code into the written files, leading to remote code execution (RCE).
3. Affected Systems and Software Versions
Affected Software:
- Cacti versions prior to 1.2.27
Affected Systems:
- Any system running the vulnerable versions of Cacti, including but not limited to:
- Linux-based servers
- Windows servers with PHP support
- Any web server hosting Cacti
4. Recommended Mitigation Strategies
Immediate Actions:
- Upgrade: Upgrade to Cacti version 1.2.27 or later, which includes a patch for this vulnerability.
- Access Control: Restrict the "Import Templates" permission to trusted users only.
- Monitoring: Implement monitoring and logging for unusual file write activities and PHP code execution.
Long-Term Strategies:
- Regular Updates: Ensure that all software, including Cacti and its dependencies, are regularly updated.
- Security Audits: Conduct regular security audits and vulnerability assessments.
- Least Privilege: Apply the principle of least privilege to user accounts and permissions.
5. Impact on European Cybersecurity Landscape
Regulatory Compliance:
- Organizations using Cacti must ensure compliance with regulations such as GDPR, which mandates the protection of personal data.
- Failure to address this vulnerability could result in data breaches, leading to regulatory fines and legal consequences.
Critical Infrastructure:
- Cacti is often used in critical infrastructure monitoring, making this vulnerability particularly concerning for sectors such as healthcare, finance, and energy.
- Compromise of such systems could lead to significant disruptions and potential loss of life.
Public Trust:
- Incidents resulting from this vulnerability could erode public trust in digital services and cybersecurity measures.
6. Technical Details for Security Professionals
Vulnerability Location:
- The vulnerability is located in the
import_package()function within the/lib/import.phpscript.
Code Analysis:
- The function does not properly validate the filename and file content provided within the XML data.
- Path traversal sequences are not filtered, allowing for directory traversal attacks.
Patch Details:
- The patch in version 1.2.27 addresses these issues by implementing proper validation and sanitization of input data.
References:
Aliases:
- CVE-2024-25641
- GSD-2024-25641
EPSS Score:
- The EPSS (Exploit Prediction Scoring System) score of 87 indicates a high likelihood of exploitation in the wild.
ENISA IDs:
- Product ID: e60d4275-3235-3a7e-aff4-c12120291a6a
- Vendor ID: ea0b4ce5-1b1f-3453-a973-a473ab0bae76
By addressing this vulnerability promptly and comprehensively, organizations can mitigate the risk of severe security incidents and maintain the integrity and availability of their systems.