CVE-2024-54146
📋 TL;DR
Cacti versions before 1.2.29 contain a SQL injection vulnerability in the host_templates.php template function via the graph_template parameter. This allows authenticated attackers to execute arbitrary SQL commands on the database. All Cacti installations with vulnerable versions are affected.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or remote code execution via database functions.
Likely Case
Data exfiltration, database manipulation, or authentication bypass through SQL injection.
If Mitigated
Limited impact due to proper input validation and parameterized queries preventing exploitation.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.29
Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-vj9g-p7f2-4wqj
Restart Required: No
Instructions:
1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.29 from the official repository. 3. Follow the Cacti upgrade documentation to apply the update. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation for the graph_template parameter to reject suspicious characters.
Web Application Firewall
allDeploy a WAF with SQL injection rules to block exploitation attempts.
🧯 If You Can't Patch
- Restrict access to the Cacti web interface to trusted IP addresses only.
- Implement database-level controls to limit the impact of SQL injection (e.g., least privilege database accounts).
🔍 How to Verify
Check if Vulnerable:
Check Cacti version via the web interface or by examining the source code version.Check Version:
grep 'version' /path/to/cacti/include/global.php | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Confirm the installed version is 1.2.29 or later and test the host_templates.php endpoint with SQL injection payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by access to host_templates.php
Network Indicators:
- HTTP POST requests to host_templates.php containing SQL keywords in parameters
SIEM Query:
source="web_access.log" AND uri="/host_templates.php" AND (param="graph_template" AND value CONTAINS "UNION" OR "SELECT" OR "INSERT")