CVE-2024-29894

What it actually does

Residual cross-site scripting flaw in raise_message_javascript allows JavaScript injection via unescaped single quotes in PHP variables $title and $header despite purify.js usage.

Why it matters to the business

Attackers can impersonate users to make unauthorized configuration changes in the monitoring system, potentially disrupting operations or altering visibility into infrastructure health.

How an attack unfolds

An attacker crafts input containing single quotes that reaches the message function, injects executable JavaScript, and executes actions under another authenticated user's session when the message is rendered.

How to fix it

Upgrade Cacti to version 1.2.27 or apply commit b577c294214b7e65a7273031ef8f0045d2a0c5af to ensure proper escaping of $title and $header.

How to confirm the fix worked

Confirm the fixed commit is present, test that single quotes in title or header no longer produce executable script, and verify the purify.js call plus additional escaping logic.

Typical attack path

1. Identify an input vector that populates $title or $header without escaping
2. Inject JavaScript payload using single quotes to break out of context
3. Trigger rendering of the message via raise_message_javascript
4. Execute actions on behalf of the victim user

How to detect it

Search web server and application logs for unusual single-quote sequences or script tags in parameters that feed into message functions; inspect rendered pages for unexpected inline scripts.

What your security team should do

• Apply the fixed version or commit immediately across all instances
• Review and sanitize all custom or third-party plugins that call raise_message_javascript
• Monitor for any post-fix XSS attempts in application logs