PT-2024-7358 · Cacti+1 · Cacti+1

Tayfunyelim · Published 2023-07-13 · Updated 2025-02-11 · CVE-2024-43362

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.28

Description: The issue is related to the lack of protection of the web page structure in the Cacti network monitoring tool, specifically in the links.php script. This allows a remote attacker to perform cross-site scripting attacks. The fileurl parameter is not properly sanitized when saving external links, leading to stored XSS. Users with the privilege to create external links can manipulate the fileurl parameter to perform stored XSS attacks. This occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping.

Recommendations: For versions prior to 1.2.28, upgrade to release version 1.2.28 to address the issue. As a temporary workaround, consider restricting access to the links.php script and limiting the ability to create external links to trusted users only. Avoid using the fileurl parameter in the HTTP post request while creating external links until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-4394

ALT-PU-2023-4396

ALT-PU-2023-5196

ALT-PU-2024-14329

ALT-PU-2024-14440

ALT-PU-2024-17822

ALT-PU-2025-1813

BDU:2024-08721

CVE-2024-43362

DLA-4048-1

DSA-5862-1

GHSA-WH9C-V56X-V77C

Affected Products

Alt Linux

Cacti

References · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/cacti_filter_sqli_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cacti_unauthenticated_cmd_injection.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43362.json · Exploit
• 🔥 https://github.com/Cacti/cacti/security/advisories/GHSA-wh9c-v56x-v77c · Exploit
• 🔥 https://github.com/mhaskar/CVE-2020-8813 · Exploit
• 🔥 https://github.com/0xf4n9x/CVE-2022-46169 · Exploit
• 🔥 https://github.com/FredBrave/CVE-2022-46169-CACTI-1.2.22 · Exploit
• 🔥 https://github.com/sAsPeCt488/CVE-2022-46169 · Exploit
• 🔥 https://github.com/ariyaadinatha/cacti-cve-2022-46169-exploit · Exploit
• 🔥 https://github.com/Anthonyc3rb3ru5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/deadyP00l/CVE-2022-46169 · Exploit
• 🔥 https://github.com/c3rrberu5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/botfather0x0/CVE-2022-46169 · Exploit