CVE-2024-43362

What it actually does

Unsanitized fileurl parameter in links.php is stored and reflected via print() in link.php and index.php, enabling persistent script injection into HTML rendered for other users.

Why it matters to the business

Attackers with link-creation rights can hijack sessions, steal credentials, or perform unauthorized actions inside the monitoring platform, risking data exposure and operational disruption; upgrade urgency is moderate given rising EPSS and public disclosure in October 2024.

How an attack unfolds

An authenticated user with external-link privileges crafts a POST request to links.php containing a fileurl value with embedded script tags; the payload is persisted in the database and later emitted unsafely by print() calls, executing the script in the context of any user who views the links page.

How to fix it

Upgrade cacti/cacti to the commit f9a7cd3d76d0a5d09cff753f9c4bb5fd26c2104c (release 1.2.28); no workarounds exist.

How to confirm the fix worked

Confirm the installed version contains commit f9a7cd3d76d0a5d09cff753f9c4bb5fd26c2104c; retest link creation with known XSS payloads to verify sanitization.

Typical attack path

1. Obtain or compromise an account permitted to create external links
2. Submit crafted POST to links.php with malicious fileurl payload
3. Wait for administrators or other users to load link.php or index.php
4. Script executes in victim browser to exfiltrate cookies, perform actions, or pivot

How to detect it

Review web-server access logs and application logs for POST requests to links.php containing fileurl values with HTML or script tags; inspect the links table for stored payloads; check user sessions for unexpected actions after link views.

• POST.*links.php.*fileurl=
• fileurl.*<script
• fileurl.*javascript:
• fileurl.*onerror=
• fileurl.*onload=

What your security team should do

• Immediately schedule upgrade to 1.2.28 for all Cacti instances
• Audit existing external links for unexpected fileurl values
• Restrict link-creation privilege to the minimum necessary accounts
• Monitor EPSS trend and re-evaluate if exploit code appears