Headline
Ubuntu Security Notice USN-6969-1
Ubuntu Security Notice 6969-1 - It was discovered that Cacti did not properly apply checks to the “Package Import” feature. An attacker could possibly use this issue to perform arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. It was discovered that Cacti did not properly sanitize values when using javascript based API. A remote attacker could possibly use this issue to inject arbitrary javascript code resulting into cross-site scripting vulnerability. This issue only affected Ubuntu 24.04 LTS.
==========================================================================
Ubuntu Security Notice USN-6969-1
August 20, 2024
cacti vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Cacti.
Software Description:
- cacti: web interface for graphing of monitoring systems
Details:
It was discovered that Cacti did not properly apply checks to the “Package
Import” feature. An attacker could possibly use this issue to perform
arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu
22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-25641)
It was discovered that Cacti did not properly sanitize values when using
javascript based API. A remote attacker could possibly use this issue to
inject arbitrary javascript code resulting into cross-site scripting
vulnerability. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-29894)
It was discovered that Cacti did not properly sanitize values when managing
data queries. A remote attacker could possibly use this issue to inject
arbitrary javascript code resulting into cross-site scripting
vulnerability. (CVE-2024-31443)
It was discovered that Cacti did not properly sanitize values when reading
tree rules with Automation API. A remote attacker could possibly use this
issue to inject arbitrary javascript code resulting into cross-site
scripting vulnerability. (CVE-2024-31444)
It was discovered that Cacti did not properly sanitize
"get_request_var(‘filter’)" values in the “api_automation.php” file. A
remote attacker could possibly use this issue to perform SQL injection
attacks. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-31445)
It was discovered that Cacti did not properly sanitize data stored in
"form_save()" function in the “graph_template_inputs.php” file. A remote
attacker could possibly use this issue to perform SQL injection attacks.
(CVE-2024-31458)
It was discovered that Cacti did not properly validate the file urls from
the lib/plugin.php file. An attacker could possibly use this issue to
perform arbitrary code execution. (CVE-2024-31459)
It was discovered that Cacti did not properly validate the data stored in
the "automation_tree_rules.php". A remote attacker could possibly use this
issue to perform SQL injection attacks. This issue only affected Ubuntu
24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS.
(CVE-2024-31460)
It was discovered that Cacti did not properly verify the user password.
An attacker could possibly use this issue to bypass authentication
mechanism. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-34360)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
cacti 1.2.26+ds1-1ubuntu0.1
Ubuntu 22.04 LTS
cacti 1.2.19+ds1-2ubuntu1.1
Ubuntu 20.04 LTS
cacti 1.2.10+ds1-1ubuntu1.1
Ubuntu 18.04 LTS
cacti 1.1.38+ds1-1ubuntu0.1~esm3
Available with Ubuntu Pro
Ubuntu 16.04 LTS
cacti 0.8.8f+ds1-4ubuntu4.16.04.2+esm2
Available with Ubuntu Pro
Ubuntu 14.04 LTS
cacti 0.8.8b+dfsg-5ubuntu0.2+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6969-1
CVE-2024-25641, CVE-2024-29894, CVE-2024-31443, CVE-2024-31444,
CVE-2024-31445, CVE-2024-31458, CVE-2024-31459, CVE-2024-31460,
CVE-2024-34340
Package Information:
https://launchpad.net/ubuntu/+source/cacti/1.2.26+ds1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/cacti/1.2.19+ds1-2ubuntu1.1
https://launchpad.net/ubuntu/+source/cacti/1.2.10+ds1-1ubuntu1.1
Related news
This exploit module leverages an arbitrary file write vulnerability in Cacti versions prior to 1.2.27 to achieve remote code execution. It abuses the Import Packages feature to upload a specially crafted package that embeds a PHP file. Cacti will extract this file to an accessible location. The module finally triggers the payload to execute arbitrary PHP code in the context of the user running the web server. Authentication is needed and the account must have access to the Import Packages feature. This is granted by setting the Import Templates permission in the Template Editor section.
Cacti versions 1.2.26 and below suffer from a remote code execution execution vulnerability in import.php.
### Impact Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule and can serve as an attack vector where Nodes are rewarded for holding their PoST data for less than one epoch but still being eligible for rewards. ### Patches - API needs to be extended to be able to fetch events from a node that dected malicious behavior of this regard by the node - go-spacemesh needs to be patched to a) not allow publishing these ATXs any more and b) create malfeasance proofs for identities that published invalid ATXs in the past. ### Workarounds n/a ### References Spacemesh protocol whitepaper: https://spacemesh.io/blog/spacemesh-white-paper-1/, specifically sections 4.4.2 ("ATX Contents") and 4.4.3 ("ATX validity")