CVE-2024-43363

What it actually does

An authenticated admin can inject PHP code into a device hostname, force the application to treat a PHP file as its log target via a partial reinstall, and trigger log poisoning that results in arbitrary command execution when the poisoned log is requested.

Why it matters to the business

Successful exploitation grants an attacker full control over the monitoring server, enabling theft or alteration of network performance data, lateral movement into the monitored environment, and potential disruption of operational visibility.

How an attack unfolds

An attacker with admin credentials creates a device whose hostname contains PHP code, completes only the log-file selection step of the installer to redirect logging to a web-accessible .php file, waits for the poisoned entry to be written, then requests the log URL to execute the injected code and obtain a shell.

How to fix it

Upgrade Cacti to version 1.2.28 or apply commit f9a7cd3d76d0a5d09cff753f9c4bb5fd26c2104c; no workarounds exist.

How to confirm the fix worked

Verify the installed version is 1.2.28 or later; confirm the commit hash f9a7cd3d76d0a5d09cff753f9c4bb5fd26c2104c is present in the running codebase; attempt to reproduce the device-creation and log-selection steps to ensure the malicious hostname is rejected or sanitized.

Typical attack path

1. Obtain admin credentials or session on the Cacti web interface
2. Create a new device and set its hostname to a string containing PHP code
3. Initiate the installation wizard and advance only to the step that allows selection of the log file path
4. Choose a web-reachable .php file as the log target
5. Trigger logging activity so the malicious hostname appears in the log
6. Directly request the log file URL to execute the embedded PHP and obtain remote code execution

How to detect it

Search web and application logs for requests to the Cacti log file URL containing .php extensions; inspect device creation events for hostnames that include PHP opening tags or code fragments; review installation or configuration change logs for unexpected log-file path modifications.

• hostname containing <?php
• POST or GET to /log/.*\.php
• log file path changed to .php during install step 5

What your security team should do

• Immediately upgrade all Cacti instances to 1.2.28
• Restrict admin interface access to trusted networks and require MFA
• Monitor for unexpected changes to log file paths or device hostnames containing PHP syntax
• Review and harden installation and configuration workflows that allow log redirection