CVE-2023-49084 – This CVE-2023-49084 vulnerability in Cacti allo... (How to Fix)

Q: What is the severity of CVE-2023-49084?

CVE-2023-49084 has a CVSS score of 8.0 (HIGH). This CVE-2023-49084 vulnerability in Cacti allows authenticated users to perform SQL injection and arbitrary code execution on the server through the link.php component. Attackers can exploit insufficient file path processing to execute malicious code with server privileges. All Cacti installations with vulnerable versions are affected.

📋 TL;DR

This CVE-2023-49084 vulnerability in Cacti allows authenticated users to perform SQL injection and arbitrary code execution on the server through the link.php component. Attackers can exploit insufficient file path processing to execute malicious code with server privileges. All Cacti installations with vulnerable versions are affected.

💻 Affected Systems

Products:

Cacti

Versions: Versions before 1.2.26

Operating Systems: All operating systems running Cacti

Default Config Vulnerable: ⚠️ Yes

Notes: All Cacti installations with vulnerable versions are affected regardless of configuration. The vulnerability requires authenticated access but does not require special permissions.

📦 What is this software?

Cacti by Cacti

View all CVEs affecting Cacti →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise allowing attackers to execute arbitrary commands, steal data, install backdoors, pivot to other systems, and maintain persistent access.

🟠

Likely Case

Attackers gain shell access to the server, potentially compromising the Cacti database, modifying monitoring data, and using the server as a foothold for lateral movement.

🟢

If Mitigated

Limited impact due to network segmentation, minimal privileges, and monitoring that detects exploitation attempts before full compromise.

🌐 Internet-Facing: HIGH - Cacti is often exposed to the internet for monitoring purposes, making it accessible to attackers who can obtain or compromise credentials.

🏢 Internal Only: MEDIUM - Requires authenticated access, but internal attackers or compromised accounts could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward with published proof-of-concept code. The vulnerability combines SQL injection with file inclusion for code execution.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.26 and later

Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp

Restart Required: No

Instructions:

1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.26 or later from the official repository. 3. Follow the upgrade instructions at https://docs.cacti.net/Upgrading. 4. Verify the installation works correctly.

🔧 Temporary Workarounds

Restrict access to link.php

linux

Temporarily block or restrict access to the vulnerable link.php file using web server configuration or firewall rules.

# Apache: Add to .htaccess or virtual host config
<Files "link.php">
    Order deny,allow
    Deny from all
</Files>
# Nginx: Add to server block
location ~ /link\.php$ {
    deny all;
    return 403;
}

Remove vulnerable file

linux

Temporarily rename or remove the link.php file to prevent exploitation while maintaining other Cacti functionality.

mv /path/to/cacti/link.php /path/to/cacti/link.php.disabled

🧯 If You Can't Patch

Implement strict network segmentation to isolate Cacti servers from critical systems.
Enforce strong authentication controls and monitor for suspicious account activity.

🔍 How to Verify

Check if Vulnerable:

Check Cacti version by viewing the About page in the web interface or examining the version.php file.

Check Version:

grep '\$version' /path/to/cacti/include/global.php | head -1

Verify Fix Applied:

Verify the installed version is 1.2.26 or later and test that link.php functionality works without errors.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in Cacti logs
Unexpected file inclusion attempts in web server logs
Multiple failed authentication attempts followed by successful login

Network Indicators:

Unusual outbound connections from Cacti server
Traffic patterns suggesting command and control communication

SIEM Query:

source="cacti.log" AND ("link.php" OR "SQL error" OR "file inclusion")

📊 Metadata

CVE ID: CVE-2023-49084

CVSS v3 Score: 8.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-98

Published: December 21, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-49084, you might also want to check these: