CVE-2023-39361

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

This update for cacti, cacti-spine fixes the following issues:

cacti-spine 1.2.25:

• Spine should see if script to be executed is executable
• Enhance number recognition
• When polling devices, sort by larger number of items first
• Log format may be corrupted when timeout occurs
• Compile warning appears due to GCC flag on RHEL7/RHEL8
• Downed device detection only checks one of the two uptime OIDs
• Compile error appears due to execinfo.h on FreeBSD
• Bootstrap shell script contains some PHP cruft
• Padding is not always removed from the start of non-numeric strings
• Improve SNMP result handling for non-numeric results
• Further improve SNMP result handling for non-numeric results
• Remove check for the max_oids column which has been present since Cacti v1.0
• Minimize Sorting when fetching poller records for maximum performance
• Spine should see if script to be executed is executable

cacti-spine 1.2.24:

• Fix segfault when ignoring older OIDs

cacti 1.2.25:

• CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082)
• CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044)
• CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045)
• CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040)
• CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047)
• CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043)
• CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042)
• CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051)
• CVE-2023-39364: redirect in change password functionality (boo#1215050)
• CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052)
• CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053)
• CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081)
• CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054)
• CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055)
• CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056)
• CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058)
• CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059)
• When rebuilding the Poller Cache from command line, allow it to be multi-threaded
• When searching tree or list views, the URL does not update after changes
• When creating a Data Source Template with a specific snmp port, the port is not always applied
• When a Data Query references a file, the filename should be trimmed to remove spurious spaces
• THold plugin may not always install or upgrade properly
• RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template
• When reindexing devices, errors may sometimes be shown
• Boost may loose data when the database server is overloaded
• Boost can sometimes output unexpected or invalid values
• Boost should not attempt to start if there are no items to process
• Rebuilding the poller cache does not always work as expected
• Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled
• When creating new graphs, invalid offset errors may be generated
• When importing packages, SQL errors may be generated
• When managing plugins from command line, the --plugin option is not properly handled
• When automating an install of Cacti, error messages can be appear
• When performing automated install of a plugin, warnings can be thrown
• Automation…

These are all security issues fixed in the cacti-1.2.25-2.1 package on the GA media of openSUSE Tumbleweed.

Kentaro Kawane discovered that Cacti incorrectly handled user provided input sent through request parameters to the graph_view.php script. A remote authenticated attacker could use this issue to perform SQL injection attacks.