CVE-2024-30268

What it actually does

Reflected cross-site scripting flaw allows injection of arbitrary JavaScript via crafted URL parameters that executes in the context of an authenticated Cacti user session, enabling theft of session cookies.

Why it matters to the business

Attackers can hijack administrator accounts on the monitoring platform, leading to unauthorized access to network device data, configuration changes, or further internal system compromise.

How an attack unfolds

An attacker crafts a malicious URL containing a reflected XSS payload targeting a Cacti 1.3.x development instance, delivers the link to an administrator via phishing or another channel, and upon execution in the victim's browser the script exfiltrates session cookies allowing the attacker to replay them and impersonate the administrator.

How to fix it

Upgrade the cacti/cacti repository to commit a38b9046e9772612fda847b46308f9391a49891e or later; apply the patch immediately given the 883 days since publication and absence of any other mitigations.

How to confirm the fix worked

Verify the presence of commit a38b9046e9772612fda847b46308f9391a49891e in the source tree; re-test the previously vulnerable endpoints with a benign reflected script to confirm execution is blocked.

Typical attack path

1. Locate an internet-facing or internally reachable Cacti 1.3.x development instance
2. Craft a reflected XSS payload that targets administrative pages and steals cookies
3. Deliver the malicious link to an administrator through email, chat, or other means
4. Victim clicks the link while authenticated, causing the script to execute and send cookies to the attacker
5. Attacker replays the stolen cookies to authenticate as the administrator and perform actions

How to detect it

Inspect web server access logs and Cacti application logs for requests containing reflected script payloads, unusual query parameters on administrative pages, or sudden cookie exfiltration patterns; correlate with successful authentication events using previously unseen cookies or IPs.

• script> in query parameters on Cacti admin endpoints
• cookie exfiltration via img or script src to external domains in access logs
• unusual Referer values leading to Cacti administrative URIs

What your security team should do

• Apply the fixed commit a38b9046e9772612fda847b46308f9391a49891e to all Cacti 1.3.x development deployments without delay
• Review web server and application logs for suspicious requests containing script tags or unusual parameters targeting Cacti endpoints
• Monitor for anomalous administrator logins or session activity originating from unexpected locations or user-agents
• Consider adding input sanitization and output encoding controls around reflected parameters as a defense-in-depth measure