Path Traversal in Cacti via format_file Parameter

Executive Summary

This vulnerability affects Cacti versions 1.2.30 and earlier. It is a Path Traversal vulnerability involving the 'format_file' parameter in report generation. The issue occurs in two stages: first, the 'format_file' parameter is stored directly into the database without validation, allowing malicious input to be saved. Second, when the report is generated, the application reads the file specified by this parameter from the filesystem without proper sanitization, enabling an attacker to read arbitrary files on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited privileges to read arbitrary files on the server where Cacti is installed. This could lead to exposure of sensitive information such as configuration files, credentials, or other data stored on the system, potentially compromising the security of the affected environment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Cacti to version 1.2.31 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows arbitrary file read through a path traversal attack, potentially exposing sensitive information stored on the affected system.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and health information against unauthorized access.

However, specific impacts on compliance depend on the nature of the data exposed and the environment in which Cacti is deployed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Cacti installation is running version 1.2.30 or earlier, as these versions are vulnerable to arbitrary file read via path traversal through the format_file parameter.

To detect exploitation attempts on your system or network, you can monitor HTTP POST requests to the report management functionality that include suspicious path traversal sequences such as "../../" in the format_file parameter.

Example commands to detect such attempts in web server logs (assuming Apache logs) include:

• grep -i 'POST' /var/log/apache2/access.log | grep 'format_file=.*\.\./'
• grep -E 'format_file=.*\.\./' /var/log/apache2/access.log

Additionally, you can search your Cacti database for entries in the reports table where the format_file field contains path traversal sequences, indicating stored injection attempts.

For example, using a SQL query:

• SELECT * FROM report_formats WHERE format_file LIKE '%../%';

If such entries exist, it indicates the vulnerability may have been exploited or attempted.

Useful 0 Not Useful 0