Security Affairspublished Jan 14, 21:24 UTC (Jan 14, 2023)ingested Sep 10, 06:12 UTC@securityaffairs

Most internet

criticalExploit / PoC exploited in the wildimportance 60CVE-2022-46169

Read the original

Tagscve-2022-46169 exploit

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2022-46169	Unauthenticated Command Injection in Cacti (CVE-2022-46169) Cacti, a widely used open-source network monitoring and graphing platform, contains a command injection flaw (CWE-74) that lets a completely unauthenticated attacker execute arbitrary commands on the Cacti server. The bug is reachable through the web-facing remote_agent.php script, where an attacker can spoof a trusted poller address (e.g., via a forwarded-client HTTP header) to bypass authentication and inject shell metacharacters into parameters used to build polling commands. Successful exploitation yields code execution in the context of the web server, giving an attacker a foothold on a monitoring system that typically has broad network visibility and stored credentials for many managed devices. Any Cacti deployment running vulnerable code is affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild — the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-02-16, and EPSS assigns it a 99.8% probability of exploitation. Do: Apply CISA's required action by upgrading Cacti to the patched release (1.2.23 or later per vendor guidance). Until patched, restrict access to remote_agent.php to known poller source addresses and monitor web access and Cacti logs for signs of exploitation. Prioritize internet-exposed Cacti servers, since KEV listing confirms active exploitation and ransomware use is listed as unknown.	9.8	100%	KEV PoC	Cacti CISA data lists no explicit version range; public advisories describe releases prior to 1.2.23 as vulnerable	largetens of thousands of internet-exposed instances (roughly 10,000-50,000 Cacti web frontends visible in public scans), plus an unknown additional population of…	Dec 5, 2022

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2022-46169

Unauthenticated Command Injection in Cacti (CVE-2022-46169)

Cacti, a widely used open-source network monitoring and graphing platform, contains a command injection flaw (CWE-74) that lets a completely unauthenticated attacker execute arbitrary commands on the Cacti server. The bug is reachable through the web-facing remote_agent.php script, where an attacker can spoof a trusted poller address (e.g., via a forwarded-client HTTP header) to bypass authentication and inject shell metacharacters into parameters used to build polling commands. Successful exploitation yields code execution in the context of the web server, giving an attacker a foothold on a monitoring system that typically has broad network visibility and stored credentials for many managed devices. Any Cacti deployment running vulnerable code is affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild — the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-02-16, and EPSS assigns it a 99.8% probability of exploitation.

Do: Apply CISA's required action by upgrading Cacti to the patched release (1.2.23 or later per vendor guidance). Until patched, restrict access to remote_agent.php to known poller source addresses and monitor web access and Cacti logs for signs of exploitation. Prioritize internet-exposed Cacti servers, since KEV listing confirms active exploitation and ransomware use is listed as unknown.

9.8

100%

KEV PoC

Cacti CISA data lists no explicit version range; public advisories describe releases prior to 1.2.23 as vulnerable

largetens of thousands of internet-exposed instances (roughly 10,000-50,000 Cacti web frontends visible in public scans), plus an unknown additional population of…

Dec 5, 2022

Full article324 words · extracted from securityaffairs.com · click to collapse

Most internet-exposed Cacti servers are vulnerable to the critical vulnerability CVE-2022-46169 which is actively exploited in the wild.

Cacti is an open-source platform that provides a robust and extensible operational monitoring and fault management framework for users.

Researchers from Censys discovered that the majority of internet-exposed Cacti servers are vulnerable to the critical flaw CVE-2022-46169 which is under active exploitation in the wild.

The flaw is a command injection vulnerability that can be exploited by an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The flaw resides in the `remote_agent.php` file that can be accessed by any unauthenticated user. The vulnerability affects versions 1.2.22 and below.

“A command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device.” reads the advisory.

The researcher noticed that most of the Cacti servers are running outdated versions, with only 26 servers are running a patched version of Cacti (1.2.23 and 1.3.0).

Most hosts running Cacti are in Brazil (20.54%), followed by Indonesia (12.37%) and the United States (3.95%).

Country	hosts
Brazil	1,320	20.54%
Indonesia	795	12.37%
United States	254	3.95%
China	193	3.0%
Bangladesh	104	1.62%
Russia	99	1.54%
Ukraine	93	1.45%
Philippines	70	1.09%
Thailand	65	1.01%
United Kingdom	56	0.87%

The vulnerability was discovered by Sonarsource researchers, who provided details about the issue and published a video PoC demonstrating the exploitation of a server running a vulnerable version of Cacti:

Shadowserver researchers reported that threat actors are actively exploiting the issue since January 3rd, 2023, in some attacks attackers triggered the issue to deploy malware on the vulnerable hosts.

GreyNoise experts also observed attacks in the wild exploiting the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2022-46169)

[adrotate banner=”5″]

[adrotate banner=”13″]

Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/140797/hacking/cacti-servers-cve-2022-46169-flaw.html