Vulnerability · Published May 13, 2024 · Assigned by GitHub_M
CVE-2024-34340Authentication Bypass when using using older password hashes
Critical 9.1
In plain English
A critical-severity improper authentication in cacti from Cacti. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | cacti | 1.2.27-r0 | ALPINE-CVE-2024-34340 |
| Alpine:v3.21 | cacti | 1.2.27-r0 | ALPINE-CVE-2024-34340 |
| Alpine:v3.22 | cacti | 1.2.27-r0 | ALPINE-CVE-2024-34340 |
| Alpine:v3.23 | cacti | 1.2.27-r0 | ALPINE-CVE-2024-34340 |
| Alpine:v3.24 | cacti | 1.2.27-r0 | ALPINE-CVE-2024-34340 |
| Debian:12 | cacti | 1.2.24+ds1-1+deb12u3 | DEBIAN-CVE-2024-34340 |
| Debian:13 | cacti | 1.2.27+ds1-1 | DEBIAN-CVE-2024-34340 |
| Debian:14 | cacti | 1.2.27+ds1-1 | DEBIAN-CVE-2024-34340 |
| Ubuntu:22.04:LTS | cacti | 1.2.19+ds1-2ubuntu1.1 | USN-6969-1 |
| Ubuntu:22.04:LTS | cacti | 1.2.19+ds1-2ubuntu1.1 | UBUNTU-CVE-2024-34340 |
| Ubuntu:24.04:LTS | cacti | 1.2.26+ds1-1ubuntu0.1 | UBUNTU-CVE-2024-34340 |
| Ubuntu:24.04:LTS | cacti | 1.2.26+ds1-1ubuntu0.1 | USN-6969-1 |
Affected products (as reported)
Weakness: CWE-287, CWE-697 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N