CVE-2024-27082

What it actually does

The vulnerability permits an authenticated attacker to inject persistent malicious JavaScript into application data stores; the script is later retrieved and executed in the browsers of other users who view the affected pages, enabling session hijacking, data exfiltration, or unauthorized actions within the monitoring interface.

Why it matters to the business

Compromise of monitoring dashboards can expose sensitive network topology and performance data, allow attackers to manipulate operational views, or pivot to other systems, increasing risk of prolonged undetected access and operational disruption for organizations relying on Cacti.

How an attack unfolds

An attacker authenticates with low privileges, submits a crafted payload containing script tags through a vulnerable input field or form, the payload is stored without sanitization, and is subsequently rendered and executed when any user loads the page containing the stored data.

How to fix it

Upgrade all instances of cacti/cacti to the version containing commit b577c294214b7e65a7273031ef8f0045d2a0c5af (equivalent to 1.2.27). After upgrade, clear any previously stored malicious content from the database and review user permissions to enforce least privilege.

How to confirm the fix worked

Confirm the running version reports 1.2.27 or newer; inspect the patched files for proper output encoding or escaping functions; attempt to store and retrieve a benign script tag in test fields to verify sanitization is active.

Typical attack path

1. Locate an internet-facing or internal Cacti instance
2. Authenticate using a low-privileged account
3. Submit malicious JavaScript via an unsanitized input field
4. Wait for or lure a higher-privileged user to view the affected page
5. Execute browser-based actions such as cookie theft or administrative function abuse

How to detect it

Inspect web server access logs for requests containing HTML tags or encoded script content directed at Cacti endpoints; query the application database for records containing script, img, or onerror attributes in text fields used by the graphing or device management modules.

What your security team should do

• Upgrade every Cacti deployment to the fixed commit immediately
• Audit all stored data fields for residual script content
• Restrict Cacti administrative interfaces to trusted networks
• Enable web application firewall rules that block or sanitize script tags in monitored parameters
• Review and reduce the number of accounts with write access to vulnerable forms