CVE-2024-31459

What it actually does

File inclusion vulnerability in lib/plugin.php where api_plugin_hook() reads plugin_hooks and plugin_config tables and directly concatenates values into include paths, enabling arbitrary file inclusion when chained with SQL injection to achieve remote code execution.

Why it matters to the business

Successful exploitation grants attackers remote code execution on monitoring servers, risking loss of operational visibility, infrastructure compromise, and disruption of fault management capabilities.

How an attack unfolds

An attacker first leverages SQL injection to insert malicious entries into the plugin_hooks or plugin_config tables, then invokes api_plugin_hook() which constructs and includes attacker-controlled file paths, resulting in arbitrary code execution on the server.

How to fix it

Upgrade Cacti to version 1.2.27 or later by applying the patch from commit b577c294214b7e65a7273031ef8f0045d2a0c5af which sanitizes database values before path concatenation.

How to confirm the fix worked

Confirm deployment of version 1.2.27 or the referenced commit; inspect lib/plugin.php to ensure database reads are no longer directly used in file path construction for includes.

Typical attack path

1. Locate exposed Cacti instance and identify database access via SQL injection
2. Inject crafted data into plugin_hooks or plugin_config tables
3. Trigger api_plugin_hook() function to force inclusion of the injected path
4. Execute arbitrary code on the target server

How to detect it

Review database contents of plugin_hooks and plugin_config tables for unexpected file paths, examine web server and application logs for anomalous includes involving plugin.php, and search for post-exploitation artifacts such as unexpected processes or files loaded from unusual locations.

What your security team should do

• Immediately upgrade all Cacti installations to the patched version
• Audit plugin_hooks and plugin_config tables for unauthorized entries
• Restrict database access and input validation for plugin-related queries
• Monitor application logs for unexpected include operations