CVE-2024-25641
📋 TL;DR
CVE-2024-25641 is an arbitrary file write vulnerability in Cacti's Package Import feature that allows authenticated users with 'Import Templates' permission to write arbitrary files to the web server, potentially leading to remote code execution. This affects Cacti installations prior to version 1.2.27. The vulnerability stems from insufficient validation of XML input in the import_package() function.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via arbitrary PHP code execution, leading to data theft, lateral movement, or ransomware deployment.
Likely Case
Authenticated attackers with Import Templates permission gain remote code execution on the Cacti server.
If Mitigated
Limited to authenticated users with specific permissions; proper access controls reduce exposure.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once credentials are obtained; public exploit details exist in disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.27
Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88
Restart Required: No
Instructions:
1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.27 from the official repository. 3. Replace existing files with the patched version. 4. Verify the installation works correctly.
🔧 Temporary Workarounds
Disable Package Import Feature
allRemove or restrict access to the Package Import functionality to prevent exploitation.
# Remove import_package() function from /lib/import.php or restrict file permissions
Restrict User Permissions
allReview and remove 'Import Templates' permission from all non-essential users.
# Check user permissions in Cacti web interface under User Management
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Cacti servers from critical systems.
- Enable detailed logging and monitoring for any Package Import activity and file writes.
🔍 How to Verify
Check if Vulnerable:
Check Cacti version via web interface or by examining the /include/cacti_version.php file.Check Version:
grep '\$version' /path/to/cacti/include/cacti_version.phpVerify Fix Applied:
Confirm version is 1.2.27 or later and test Package Import functionality with safe XML files.📡 Detection & Monitoring
Log Indicators:
- Unusual XML import activity in Cacti logs
- File write operations to unexpected locations in system logs
Network Indicators:
- HTTP POST requests to import.php with XML payloads
SIEM Query:
source="cacti.log" AND "import_package" AND ("xml" OR "package")🔗 References
- http://seclists.org/fulldisclosure/2024/May/6
- https://github.com/Cacti/cacti/commit/eff35b0ff26cc27c82d7880469ed6d5e3bef6210
- https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
- http://seclists.org/fulldisclosure/2024/May/6
- https://github.com/Cacti/cacti/commit/eff35b0ff26cc27c82d7880469ed6d5e3bef6210
- https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88
- https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
