Critical Flaws in Cacti Framework Could Let Attackers Execute Malicious Code

The maintainers of the Cacti open up-resource network monitoring and fault administration framework have dealt with a dozen security flaws, including two critical issues that could guide to the execution of arbitrary code.

The most intense of the vulnerabilities are detailed under –

• CVE-2024-25641 (CVSS score: 9.1) – An arbitrary file compose vulnerability in the “Deal Import” aspect that enables authenticated people possessing the “Import Templates” permission to execute arbitrary PHP code on the web server, ensuing in remote code execution

• CVE-2024-29895 (CVSS rating: 10.) – A command injection vulnerability enables any unauthenticated consumer to execute arbitrary command on the server when the “register_argc_argv” alternative of PHP is On

Also resolved by Cacti are two other high-severity flaws that could lead to code execution by way of SQL injection and file inclusion –

• CVE-2024-31445 (CVSS rating: 8.8) – An SQL injection vulnerability in api_automation.php that permits authenticated customers to carry out privilege escalation and distant code execution

• CVE-2024-31459 (CVSS rating: N/A) – A file inclusion issue in the “lib/plugin.php” file that could be merged with SQL injection vulnerabilities to consequence in remote code execution

It is really truly worth noting that 10 out of the 12 flaws, with the exception of CVE-2024-29895 and CVE-2024-30268 (CVSS rating: 6.1), impression all versions of Cacti, which includes and prior to 1.2.26. They have been tackled in variation 1.2.27 released on Could 13, 2024. The two other flaws impact the growth versions 1.3.x.

The advancement arrives additional than eight months soon after the disclosure of yet another critical SQL injection vulnerability (CVE-2023-39361, CVSS rating: 9.8) that could allow an attacker to obtain elevated permissions and execute malicious code.

In early 2023, a 3rd critical flaw tracked as CVE-2022-46169 (CVSS rating: 9.8) came beneath active exploitation in the wild, letting menace actors to breach internet-uncovered Cacti servers to provide botnet malware this kind of as MooBot and ShellBot.

With evidence-of-concept (PoC) exploits publicly obtainable for these shortcomings (in the respective GitHub advisories), it is proposed that consumers just take ways to update their situations to the most current model as before long as attainable to mitigate likely threats.

Observed this post attention-grabbing? Observe us on Twitter  and LinkedIn to examine more exceptional content we article.

Some parts of this article are sourced from:
thehackernews.com