Critical Flaws in Cacti Framework Could Let Attackers Execute Malicious Code

Cacti, a widely used open-source network monitoring and graphing platform, contains a command injection flaw (CWE-74) that lets a completely unauthenticated attacker execute arbitrary commands on the Cacti server. The bug is reachable through the web-facing remote_agent.php script, where an attacker can spoof a trusted poller address (e.g., via a forwarded-client HTTP header) to bypass authentication and inject shell metacharacters into parameters used to build polling commands. Successful exploitation yields code execution in the context of the web server, giving an attacker a foothold on a monitoring system that typically has broad network visibility and stored credentials for many managed devices. Any Cacti deployment running vulnerable code is affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild — the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-02-16, and EPSS assigns it a 99.8% probability of exploitation.

Do: Apply CISA's required action by upgrading Cacti to the patched release (1.2.23 or later per vendor guidance). Until patched, restrict access to remote_agent.php to known poller source addresses and monitor web access and Cacti logs for signs of exploitation. Prioritize internet-exposed Cacti servers, since KEV listing confirms active exploitation and ransomware use is listed as unknown.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.