SQL Injection in Cacti via Unsanitized rfilter Parameter

Executive Summary

This vulnerability exists in Cacti versions 1.2.30 and prior, where the 'rfilter' request variable is concatenated directly into a RLIKE SQL clause without proper sanitization. Because the endpoint does not require authentication and supports guest access for graph viewing, an attacker can exploit this SQL injection vulnerability without needing to log in.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability has a high severity with a CVSS score of 9.8, indicating it can be exploited remotely without authentication. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system, allowing attackers to execute arbitrary SQL commands, potentially accessing or modifying sensitive data and disrupting service.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in Cacti versions 1.2.30 and prior is fixed in version 1.2.31.

To mitigate this vulnerability, you should immediately upgrade your Cacti installation to version 1.2.31 or later.

Additionally, if guest viewing is enabled, consider disabling it temporarily to reduce exposure until the upgrade can be applied.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated SQL injection via the rfilter request variable in Cacti versions 1.2.30 and prior. Detection can focus on monitoring HTTP requests to the vulnerable endpoint and analyzing logs for suspicious rfilter parameter usage.

You can detect attempts to exploit this vulnerability by inspecting web server access logs for requests to graph_view.php containing the rfilter parameter with suspicious or unusual SQL-like patterns.

Example command to search for suspicious rfilter usage in Apache logs:

• grep -i 'graph_view.php' /var/log/apache2/access.log | grep 'rfilter='

To detect potential SQL injection payloads, you can look for common SQL metacharacters or patterns in the rfilter parameter, such as pipes (|), braces ({, }), or SQL keywords.

• grep -E 'rfilter=.*(\||\{|\}|select|union|or|and)' /var/log/apache2/access.log

Additionally, network intrusion detection systems (NIDS) can be configured with rules to alert on HTTP requests to graph_view.php containing suspicious rfilter values.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a high severity SQL injection in Cacti versions 1.2.30 and prior, allowing unauthenticated attackers to execute arbitrary SQL commands. This can lead to unauthorized access, data disclosure, and data integrity issues.

Such security weaknesses can impact compliance with standards like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

If exploited, this vulnerability could result in exposure or alteration of protected data, potentially causing non-compliance with these regulations.

Useful 0 Not Useful 0