CVE-2019-17358
📋 TL;DR
CVE-2019-17358 is an unsafe deserialization vulnerability in Cacti that allows authenticated attackers to manipulate object data values. This could lead to arbitrary code execution, memory corruption, or unauthorized system actions. The vulnerability affects Cacti versions through 1.2.7.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker gains remote code execution on the Cacti server, potentially compromising the entire system and enabling lateral movement.
Likely Case
Authenticated user with malicious intent executes arbitrary code within the Cacti application context, leading to data theft, system manipulation, or service disruption.
If Mitigated
With proper authentication controls and network segmentation, impact is limited to the Cacti application itself rather than the underlying system.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of PHP object injection techniques. Multiple proof-of-concept examples exist in security communities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Cacti 1.2.8 and later
Vendor Advisory: https://github.com/Cacti/cacti/security/advisories
Restart Required: No
Instructions:
1. Backup Cacti configuration and database. 2. Download Cacti 1.2.8 or later from official repository. 3. Replace vulnerable lib/functions.php with patched version. 4. Verify no custom modifications are overwritten. 5. Clear PHP opcache if enabled.
🔧 Temporary Workarounds
Restrict Cacti Access
linuxLimit Cacti web interface access to trusted users only using network controls
# Configure firewall rules to restrict access
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
Implement Web Application Firewall
allDeploy WAF with rules to detect and block PHP deserialization attacks
# Example ModSecurity rule for PHP deserialization
SecRule ARGS "@rx O:[0-9]+:" "id:1001,phase:2,deny,msg:'PHP Object Injection Attempt'"
🧯 If You Can't Patch
- Implement strict authentication controls and limit Cacti access to essential personnel only
- Monitor Cacti logs for unusual activity and implement intrusion detection for PHP deserialization patterns
🔍 How to Verify
Check if Vulnerable:
Check Cacti version in web interface footer or via command: grep 'version' /path/to/cacti/include/global.phpCheck Version:
grep "\$config\['cacti_version'\]" /path/to/cacti/include/global.phpVerify Fix Applied:
Verify version is 1.2.8 or later and check lib/functions.php for proper input validation around unserialize() calls📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Cacti endpoints
- PHP errors related to unserialize() or memory corruption
- Unexpected process execution from Cacti user
Network Indicators:
- Serialized PHP objects in HTTP POST data
- Unusual outbound connections from Cacti server
SIEM Query:
source="cacti_access.log" AND (method="POST" AND (uri="/graph_view.php" OR uri="/graph.php") AND size>10000)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2019-17358
- https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php#L3109
- https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8
- https://github.com/Cacti/cacti/issues/3026
- https://lists.debian.org/debian-lts-announce/2019/12/msg00014.html
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.html
- https://seclists.org/bugtraq/2020/Jan/25
- https://security.gentoo.org/glsa/202003-40
- https://www.darkmatter.ae/xen1thlabs/
- https://www.debian.org/security/2020/dsa-4604
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2019-17358
- https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php#L3109
- https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8
- https://github.com/Cacti/cacti/issues/3026
- https://lists.debian.org/debian-lts-announce/2019/12/msg00014.html
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.html
- https://seclists.org/bugtraq/2020/Jan/25
- https://security.gentoo.org/glsa/202003-40
- https://www.darkmatter.ae/xen1thlabs/
- https://www.debian.org/security/2020/dsa-4604
