CVE-2024-31444

What it actually does

Insufficient input validation in automation_tree_rules_form_save() allows unsanitized data to be concatenated into HTML output in form_confirm(), enabling reflected or stored cross-site scripting.

Why it matters to the business

Attackers can execute scripts in the browsers of logged-in administrators, potentially leading to session hijacking, unauthorized configuration changes, or data theft within the monitoring platform.

How an attack unfolds

An attacker with low-privileged access submits crafted input through the automation tree rules form; the unsanitized payload is later rendered as HTML when another user loads the confirmation page, executing arbitrary JavaScript in that user's context.

How to fix it

Upgrade cacti/cacti to the commit b577c294214b7e65a7273031ef8f0045d2a0c5af (version 1.2.27) or later; apply input sanitization to all form data before HTML concatenation and enforce content security policy headers.

How to confirm the fix worked

Verify the installed version against the fixed commit hash; attempt to reproduce the XSS payload in a test environment and confirm that the script is no longer executed; review change logs for the patch in automation_tree_rules.php and lib/html.php.

Typical attack path

1. Locate a Cacti instance running a version prior to 1.2.27
2. Authenticate with an account that can access automation_tree_rules.php
3. Submit malicious payload via the automation_tree_rules_form_save function
4. Induce a privileged user to view the affected confirmation form
5. Execute client-side script to perform actions such as cookie theft or config modification

How to detect it

Review web server access logs and application logs for unusual parameters submitted to automation_tree_rules.php; inspect browser developer tools or proxy captures for unexpected script tags in form confirmation responses; monitor for anomalous admin session behavior after form interactions.

What your security team should do

• Immediately upgrade all Cacti installations to version 1.2.27 or the equivalent fixed commit
• Audit and restrict accounts that have access to automation tree rule forms
• Implement web application firewall rules to block common XSS patterns targeting monitoring dashboards
• Enable content security policy headers to limit script execution sources