Log in Start free

Vulnerability · Published May 13, 2024 · Assigned by GitHub_M

CVE-2024-29895Cacti command injection in cmd_realtime.php

Critical 10.0

In plain English

A critical-severity command injection in cacti from Cacti. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 98.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)98.8%top 0.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC

Official description

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTScactino fix listedUBUNTU-CVE-2024-29895
Ubuntu:25.10cactino fix listedUBUNTU-CVE-2024-29895
Ubuntu:26.04:LTScactino fix listedUBUNTU-CVE-2024-29895
Ubuntu:26.10cactino fix listedUBUNTU-CVE-2024-29895

Affected products (as reported)

VendorProductVersions
Cacti cacti = 1.3.x DEV

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References