Cacti servers under attack by attackers exploiting CVE-2022-46169
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-46169 | Unauthenticated Command Injection in Cacti (CVE-2022-46169) Cacti, a widely used open-source network monitoring and graphing platform, contains a command injection flaw (CWE-74) that lets a completely unauthenticated attacker execute arbitrary commands on the Cacti server. The bug is reachable through the web-facing remote_agent.php script, where an attacker can spoof a trusted poller address (e.g., via a forwarded-client HTTP header) to bypass authentication and inject shell metacharacters into parameters used to build polling commands. Successful exploitation yields code execution in the context of the web server, giving an attacker a foothold on a monitoring system that typically has broad network visibility and stored credentials for many managed devices. Any Cacti deployment running vulnerable code is affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild — the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-02-16, and EPSS assigns it a 99.8% probability of exploitation. Do: Apply CISA's required action by upgrading Cacti to the patched release (1.2.23 or later per vendor guidance). Until patched, restrict access to remote_agent.php to known poller source addresses and monitor web access and Cacti logs for signs of exploitation. Prioritize internet-exposed Cacti servers, since KEV listing confirms active exploitation and ransomware use is listed as unknown. | 9.8 | 100% | KEV PoC |
| largetens of thousands of internet-exposed instances (roughly 10,000-50,000 Cacti web frontends visible in public scans), plus an unknown additional population of… |
Full article351 words · extracted from helpnetsecurity.com · click to collapse
If you’re running the Cacti network monitoring solution and you haven’t updated it since early December, now is the time to do it to foil attackers exploiting a critical command injection flaw (CVE-2022-46169).
About Cacti and CVE-2022-46169
Cacti is an open-source front-end app for RRDtool, a system for logging and graphing time series data, i.e., data from sensors and systems that is recorded / collected at regular intervals to create an evolving picture of what one wants to monitor (e.g., application performance, network data, user clicks, etc.).
Cacti is usually deployed to monitor network operations and resolve problems arising from things like hardware failure or loss of connectivity.
CVE-2022-46169 is a command injection vulnerability that “allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device.”
It was patched on December 5, 2022, and users were advised to ugrade to v1.2.23 and v1.3.0 to plug the hole.
Attackers exploiting CVE-2022-46169
Since then, SonarSource researchers have released technical details about the flaw and a PoC has been published on GitHub. Naturally, in-the-wild exploitation attempts followed.
According to Censys, there are 6,427 Cacti hosts exposed on the internet, though it’s difficult to tell how many are vulnerable.
“Cacti is not the only application used to monitor the health of a set of services or a network; there are many more examples. These types of monitoring tools are excellent targets for attackers. Given that these systems are, in many ways, asset inventory databases, they contain valuable information about the layout and architecture of a network. Since these systems often have some default (usually, at the least, read-only) level of access to entire organizations (monitoring) endpoints, compromising a host like this could be the first step to infiltrating everything,” Censys experts noted.
Aside from regularly updating these types od systems, users should also restrict access to them with firewall rules, VPN or VPC segmentation, and by enabling authentication, they added.
Admins of Cacti servers who have failed to do all that should check their installation for compromise.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/01/16/exploiting-cve-2022-46169/