The maintainers of the Cacti open-source community monitoring and fault administration framework have addressed a dozen safety flaws, together with two essential points that might result in the execution of arbitrary code.
Probably the most extreme of the vulnerabilities are listed under –
- CVE-2024-25641 (CVSS rating: 9.1) – An arbitrary file write vulnerability within the “Package Import” characteristic that enables authenticated customers having the “Import Templates” permission to execute arbitrary PHP code on the net server, leading to distant code execution
- CVE-2024-29895 (CVSS rating: 10.0) – A command injection vulnerability permits any unauthenticated consumer to execute arbitrary command on the server when the “register_argc_argv” possibility of PHP is On
Additionally addressed by Cacti are two different high-severity flaws that might result in code execution by way of SQL injection and file inclusion –
- CVE-2024-31445 (CVSS rating: 8.8) – An SQL injection vulnerability in api_automation.php that enables authenticated customers to carry out privilege escalation and distant code execution
- CVE-2024-31459 (CVSS rating: N/A) – A file inclusion subject within the “lib/plugin.php” file that may very well be mixed with SQL injection vulnerabilities to end in distant code execution
It is price noting that 10 out of the 12 flaws, except for CVE-2024-29895 and CVE-2024-30268 (CVSS rating: 6.1), impression all variations of Cacti, together with and previous to 1.2.26. They’ve been addressed in model 1.2.27 launched on Could 13, 2024. The 2 different flaws have an effect on growth variations 1.3.x.
The event comes greater than eight months after the disclosure of one other essential SQL injection vulnerability (CVE-2023-39361, CVSS rating: 9.8) that might allow an attacker to acquire elevated permissions and execute malicious code.
In early 2023, a 3rd essential flaw tracked as CVE-2022-46169 (CVSS rating: 9.8) got here underneath lively exploitation within the wild, permitting menace actors to breach internet-exposed Cacti servers to ship botnet malware akin to MooBot and ShellBot.
With proof-of-concept (PoC) exploits publicly accessible for these shortcomings (within the respective GitHub advisories), it is really helpful that customers take steps to replace their situations to the most recent model as quickly as attainable to mitigate potential threats.
