Session Fixation in Cacti Open Source Monitoring Framework

Executive Summary

This vulnerability exists in Cacti versions 1.2.30 and earlier, where the application does not call session_regenerate_id() after a user logs in successfully. Specifically, the login process directly sets the session user ID without rotating the session ID, which leads to a session fixation issue.

Session fixation allows an attacker to fixate a user's session ID before login, enabling them to hijack the user's authenticated session after login.

Although the session cookie settings are configured securely (HttpOnly, SameSite=Strict, Secure for HTTPS), these settings do not prevent session fixation attacks via same-site vectors.

This issue was fixed in Cacti version 1.2.31 by ensuring session_regenerate_id() is called after login.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the absence of session_regenerate_id() after login in Cacti versions 1.2.30 and prior, leading to session fixation. Detection would involve verifying whether the session ID is regenerated upon successful login.

One way to detect this on your system is to monitor the session cookie before and after login to see if the session ID changes. If the session ID remains the same after login, the system is likely vulnerable.

You can use tools like curl or browser developer tools to inspect cookies during the login process.

• Use curl to perform a login and capture cookies: curl -c cookies.txt -d 'username=youruser&password=yourpass' https://your-cacti-instance/auth_login.php
• Use curl again to access a page after login and check if the session cookie value has changed: curl -b cookies.txt https://your-cacti-instance/some_authenticated_page.php -v

If the session ID cookie value before and after login is identical, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to hijack a legitimate user's session by fixing the session ID before the user logs in.

As a result, the attacker can gain unauthorized access to the user's account and perform actions with the user's privileges.

The impact includes potential exposure of sensitive information and unauthorized changes within the Cacti performance and fault management framework.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves session fixation due to missing session ID regeneration after login, which can lead to unauthorized access or session hijacking.

Such security weaknesses can impact compliance with standards like GDPR and HIPAA, which require protecting user data and ensuring secure authentication mechanisms to prevent unauthorized access.

Failure to properly secure sessions may result in violations of these regulations' requirements for data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is caused by missing session_regenerate_id() calls after login in Cacti versions 1.2.30 and prior, which leads to session fixation.

To mitigate this vulnerability immediately, upgrade Cacti to version 1.2.31 or later where this issue has been fixed.

Useful 0 Not Useful 0