CVE-2023-39361 – CVE-2023-39361 is a critical SQL injection vuln... (How to Fix)

Q: What is the severity of CVE-2023-39361?

CVE-2023-39361 has a CVSS score of 9.8 (CRITICAL). CVE-2023-39361 is a critical SQL injection vulnerability in Cacti's graph_view.php that allows unauthenticated attackers to execute arbitrary SQL commands. Since guest users can access this endpoint without authentication by default, attackers could potentially gain administrative privileges or execute remote code. All Cacti installations below version 1.2.25 are affected.

📋 TL;DR

CVE-2023-39361 is a critical SQL injection vulnerability in Cacti's graph_view.php that allows unauthenticated attackers to execute arbitrary SQL commands. Since guest users can access this endpoint without authentication by default, attackers could potentially gain administrative privileges or execute remote code. All Cacti installations below version 1.2.25 are affected.

💻 Affected Systems

Products:

Cacti

Versions: All versions below 1.2.25

Operating Systems: All platforms running Cacti

Default Config Vulnerable: ⚠️ Yes

Notes: Default configuration allows guest access to graph_view.php, making most installations immediately vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise through remote code execution leading to data theft, system takeover, and lateral movement within the network.

🟠

Likely Case

Database compromise, privilege escalation to administrative access, and potential data exfiltration from Cacti systems.

🟢

If Mitigated

Limited impact if guest access is disabled or proper network segmentation isolates Cacti instances.

🌐 Internet-Facing: HIGH - Unauthenticated exploitation allows remote attackers to compromise systems without any credentials.

🏢 Internal Only: HIGH - Even internal attackers or compromised internal systems can exploit this without authentication.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection in graph_view.php is straightforward to exploit, and proof-of-concept code is publicly available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.25

Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-6r43-q2fw-5wrg

Restart Required: No

Instructions:

1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.25 from the official repository. 3. Follow the upgrade instructions at https://docs.cacti.net/Upgrading. 4. Verify the upgrade completed successfully.

🔧 Temporary Workarounds

Disable Guest Access

all

Disable guest user access in Cacti configuration to prevent unauthenticated exploitation

Edit /etc/cacti/config.php or your Cacti configuration file and set $config['guest_user'] = false;

Restrict Access via Web Server

linux

Block access to graph_view.php for unauthenticated users at the web server level

For Apache: Add 'Deny from all' to .htaccess for graph_view.php
For Nginx: Add location block denying access to graph_view.php

🧯 If You Can't Patch

Immediately disable guest user access in Cacti configuration
Implement strict network segmentation to isolate Cacti instances from critical systems

🔍 How to Verify

Check if Vulnerable:

Check Cacti version via web interface or by examining the Cacti installation directory for version files

Check Version:

grep '\$version' /path/to/cacti/include/global.php | head -1

Verify Fix Applied:

Verify Cacti version is 1.2.25 or higher and test that guest users cannot access graph_view.php

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in Cacti logs
Multiple failed authentication attempts followed by graph_view.php access
Unexpected database errors in application logs

Network Indicators:

Unusual outbound connections from Cacti server
SQL injection patterns in HTTP requests to graph_view.php

SIEM Query:

source="cacti.log" AND ("graph_view.php" AND (SELECT OR UNION OR DROP OR INSERT))

📊 Metadata

CVE ID: CVE-2023-39361

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: September 5, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-39361, you might also want to check these: