CVE-2022-0730
📋 TL;DR
CVE-2022-0730 is an authentication bypass vulnerability in Cacti that allows attackers to gain unauthorized access under specific LDAP configurations. The vulnerability affects Cacti systems using LDAP authentication with certain credential types. Organizations running vulnerable Cacti versions with LDAP authentication enabled are at risk.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, access sensitive monitoring data, and pivot to other systems in the network.
Likely Case
Unauthorized access to Cacti monitoring dashboards, exposure of network infrastructure data, and potential privilege escalation within the monitoring system.
If Mitigated
Limited to authentication bypass only if proper network segmentation and access controls prevent further exploitation.
🎯 Exploit Status
Exploitation requires knowledge of LDAP configuration and specific credential manipulation. Public proof-of-concept code exists in the GitHub issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.22 and later
Vendor Advisory: https://github.com/Cacti/cacti/issues/4562
Restart Required: Yes
Instructions:
1. Backup current Cacti installation and database. 2. Download Cacti 1.2.22 or later from official repository. 3. Follow upgrade instructions at https://docs.cacti.net/Upgrading. 4. Restart web server and Cacti services.
🔧 Temporary Workarounds
Disable LDAP Authentication
linuxTemporarily switch to local authentication only until patching is complete
Edit Cacti config.php and set $config['auth_method'] = 1
Restart web server
Network Access Control
linuxRestrict access to Cacti web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Cacti from critical systems
- Enable detailed logging and monitoring for authentication attempts and access patterns
🔍 How to Verify
Check if Vulnerable:
Check Cacti version and LDAP configuration. If version < 1.2.22 and LDAP authentication is enabled, system is vulnerable.Check Version:
grep 'cacti_version' /usr/share/cacti/include/global.php | cut -d"'" -f2Verify Fix Applied:
Verify Cacti version is 1.2.22 or later and test LDAP authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Failed LDAP authentication attempts followed by successful access
- Authentication logs showing unusual credential patterns
- Access from unexpected IP addresses to admin interfaces
Network Indicators:
- Unusual HTTP POST requests to authentication endpoints
- Traffic patterns indicating credential manipulation
SIEM Query:
source="cacti.log" ("authentication" AND "bypass") OR ("LDAP" AND "unexpected")🔗 References
- https://github.com/Cacti/cacti/issues/4562
- https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
- https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVOALVZSCBFNOAAZVHTJFSFB7UDSNYQ2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZH67CCORDEYFG7NL7G6UH47PAV2PU7BA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJERS4NYIGJUXEGT6ATUQA4CBYBRDLRA/
- https://www.debian.org/security/2022/dsa-5298
- https://github.com/Cacti/cacti/issues/4562
- https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
- https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVOALVZSCBFNOAAZVHTJFSFB7UDSNYQ2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZH67CCORDEYFG7NL7G6UH47PAV2PU7BA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJERS4NYIGJUXEGT6ATUQA4CBYBRDLRA/
- https://www.debian.org/security/2022/dsa-5298
