Description
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
EPSS Score:
94%
Comprehensive Technical Analysis of EUVD-2024-26876
1. Vulnerability Assessment and Severity Evaluation
The vulnerability described in EUVD-2024-26876 is a command injection flaw in the Cacti operational monitoring and fault management framework. This vulnerability allows unauthenticated users to execute arbitrary commands on the server when the register_argc_argv option of PHP is enabled. The severity of this vulnerability is rated as critical, with a CVSS base score of 10.0. This high score is due to the ease of exploitation (low complexity), the lack of required authentication, and the significant impact on confidentiality, integrity, and availability.
2. Potential Attack Vectors and Exploitation Methods
The primary attack vector involves manipulating the $poller_id parameter, which is sourced from $_SERVER['argv']. An attacker can craft a URL that includes malicious commands, which are then executed by the server. This is possible because the register_argc_argv option is enabled by default in many PHP environments, including the main PHP Docker image.
Exploitation methods include:
- Crafting a URL with malicious commands embedded in the
$poller_idparameter. - Executing arbitrary commands on the server, leading to potential data exfiltration, system compromise, or denial of service.
3. Affected Systems and Software Versions
The vulnerability affects Cacti versions on the 1.3.x DEV branch. Specifically, systems running this version with the register_argc_argv option enabled are at risk. This includes environments where the main PHP Docker image is used, as this option is enabled by default in such configurations.
4. Recommended Mitigation Strategies
To mitigate this vulnerability, the following steps are recommended:
- Disable
register_argc_argvOption: Ensure that theregister_argc_argvoption in PHP is set toOff. This can be done by modifying thephp.iniconfiguration file. - Apply Patch: Although the initial patch (commit 53e8014d1f082034e0646edc6286cde3800c683d) was reverted, it is crucial to monitor for an official patch release and apply it as soon as it becomes available.
- Input Validation: Implement robust input validation and sanitization for all user-supplied data, especially parameters that are used in command execution.
- Regular Updates: Keep all software and dependencies up to date with the latest security patches.
- Monitoring and Logging: Enhance monitoring and logging to detect any suspicious activities or attempts to exploit this vulnerability.
5. Impact on European Cybersecurity Landscape
The impact of this vulnerability on the European cybersecurity landscape is significant. Cacti is widely used for network monitoring and management, and its compromise can lead to severe disruptions in operational monitoring and fault management. Given the critical nature of the vulnerability, organizations across Europe need to prioritize mitigation efforts to prevent potential breaches and ensure the integrity of their monitoring systems.
6. Technical Details for Security Professionals
Vulnerability Details:
- Affected File:
cmd_realtime.php - Affected Line: 119
- Vulnerable Parameter:
$poller_id - Source of Vulnerability:
$_SERVER['argv']
Exploitation Steps:
- An attacker crafts a URL with a malicious command embedded in the
$poller_idparameter. - The server processes the URL, and due to the
register_argc_argvoption being enabled, the malicious command is executed.
Patch Information:
- Initial Patch Commit: 53e8014d1f082034e0646edc6286cde3800c683d
- Reverted Commit: 99633903cad0de5ace636249de16f77e57a3c8fc
References:
Aliases:
- CVE-2024-29895
- GSD-2024-29895
Assigner: GitHub_M
EPSS Score: 94 (indicating a high likelihood of exploitation)
ENISA ID:
- Product: Cacti, Version: 1.3.x DEV
- Vendor: Cacti
By addressing this vulnerability promptly and effectively, organizations can significantly reduce the risk of exploitation and maintain the security and integrity of their monitoring systems.