CVE-2025-24367
📋 TL;DR
An authenticated Cacti user can abuse graph creation functionality to write arbitrary PHP files to the web root, leading to remote code execution on the server. This affects all Cacti installations with versions before 1.2.29 where users have graph creation permissions.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining shell access, data exfiltration, lateral movement, and persistence establishment.
Likely Case
Attacker creates web shells to execute arbitrary commands, potentially leading to data theft, service disruption, or further network compromise.
If Mitigated
Limited impact if proper authentication controls, file integrity monitoring, and least privilege principles are enforced.
🎯 Exploit Status
Requires authenticated access and knowledge of graph template functionality. The advisory provides technical details but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.29
Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
Restart Required: No
Instructions:
1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.29 from the official repository. 3. Replace existing files with new version. 4. Run database upgrade if prompted. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict Graph Creation Permissions
allTemporarily remove graph creation permissions from non-admin users to prevent exploitation.
UPDATE user_auth SET policy_graphs = 0 WHERE id != 1;
File Integrity Monitoring
allMonitor web root for unauthorized PHP file creation using file integrity monitoring tools.
# Use tools like AIDE, Tripwire, or OSSEC to monitor /var/www/html/cacti/ directory
🧯 If You Can't Patch
- Implement strict access controls to limit graph creation to trusted administrators only.
- Deploy web application firewall rules to block suspicious file write patterns to the web root.
🔍 How to Verify
Check if Vulnerable:
Check Cacti version via web interface or by examining version.php file. If version is below 1.2.29, system is vulnerable.Check Version:
grep '\$version' /path/to/cacti/include/global.php | head -1Verify Fix Applied:
After patching, verify version shows 1.2.29 in web interface and test that graph creation functions work normally without errors.📡 Detection & Monitoring
Log Indicators:
- Unusual graph template creation events
- PHP file creation in web root outside normal operations
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual HTTP POST requests to graph creation endpoints
- Unexpected file upload patterns to Cacti web paths
SIEM Query:
source="cacti.log" AND (event="graph_template_save" OR event="graph_create") | stats count by user