PT-2024-3456 · Php+1 · Php+1

Liotree · Published 2024-03-27 · Updated 2024-10-16 · CVE-2024-29895

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cacti versions 1.3.x

Description A command injection vulnerability allows any unauthenticated user to execute arbitrary commands on the server when the register argc argv option of PHP is On. The vulnerability is located in cmd realtime.php and is exploited through the $poller id variable, which can be controlled by URL when register argc argv is On. This option is On by default in many environments.

Recommendations For Cacti version 1.3.x, consider disabling the cmd realtime.php functionality until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the poller id variable in the affected API endpoint until the issue is resolved. Update to a version that includes the patch for the issue, as commit 53e8014d1f082034e0646edc6286cde3800c683d contains a fix, but ensure it is not reverted like in commit 99633903cad0de5ace636249de16f77e57a3c8fc.

Note: The provided information does not include details about the number of potentially affected devices or real-world incidents.

Exploit

Fix

Command Injection

Special Elements Injection

XSS

Improper Neutralization

OS Command Injection

Weakness Enumeration

CWE-77

CWE-74

CWE-79

CWE-707

CWE-78

Related Identifiers

BDU:2024-03742

BDU:2024-03924

CVE-2024-29895

GHSA-CR28-X256-XF5M

Affected Products

Cacti

Php

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29895.json · Exploit
• 🔥 https://github.com/Stuub/CVE-2024-29895-CactiRCE-PoC · Exploit
• 🔥 https://github.com/Rubioo02/CVE-2024-29895 · Exploit
• https://ubuntu.com/security/CVE-2024-29895 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-29895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29895 · Security Note
• https://bdu.fstec.ru/vul/2024-03924 · Security Note
• https://bdu.fstec.ru/vul/2024-03742 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-29895 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29895 · Vendor Advisory
• https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/cmd_realtime.php#L119 · Note
• https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364e/settings.php#L66 · Note
• https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a49891e · Note
• https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q · Note
• https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m · Note