Open Redirect Vulnerability in Cacti Framework

Compliance Impact

The vulnerability allows an attacker to redirect users to malicious websites after login, which can lead to phishing attacks or other malicious activities.

Such open redirect vulnerabilities can potentially expose users to data theft or unauthorized access, which may impact compliance with standards like GDPR or HIPAA that require protection of user data and secure authentication processes.

However, the provided information does not explicitly discuss the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects Cacti versions 1.2.30 and earlier. It is an Open Redirect issue caused by improper validation of the HTTP referer header during login redirection. Specifically, the code checks if the referer contains a certain substring (CACTI_PATH_URL) rather than verifying the host properly. An attacker can exploit this by crafting a malicious referer URL that includes the substring but points to an external site, causing users to be redirected to a malicious website after login.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to users being redirected to malicious websites after logging in, which can facilitate phishing attacks or other social engineering exploits. It may cause users to unknowingly disclose sensitive information or credentials to attackers. The vulnerability has a CVSS base score of 6.1, indicating a medium severity with potential impacts on confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Cacti version 1.2.31. The immediate step to mitigate this vulnerability is to upgrade your Cacti installation to version 1.2.31 or later.

This update ensures that the proper validation function validate_redirect_url() is used to prevent open redirect attacks caused by improper substring checks on the HTTP referer header.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the Cacti login page that contain suspicious or malicious HTTP_REFERER headers. Specifically, look for referer URLs that include the Cacti path substring but originate from external or untrusted domains, such as URLs like https://evil.com/cacti/.

You can use network traffic inspection tools or web server logs to identify such requests.

Example commands to detect potentially malicious referer headers in web server logs (assuming Apache logs):

• grep -i 'Referer: .*\/cacti\/' /var/log/apache2/access.log | grep -v 'your-cacti-domain.com'
• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'Referer: .*\/cacti\/'

These commands search for HTTP_REFERER headers containing the Cacti path but exclude legitimate internal domains, helping to identify attempts to exploit the open redirect vulnerability.

Useful 0 Not Useful 0