CVE-2024-43364

What it actually does

Improper sanitization of the title parameter in links.php allows an authenticated user to store a malicious script in the database that is later reflected without escaping on index.php, enabling stored cross-site scripting.

Why it matters to the business

Attackers with link-creation rights can hijack sessions of other users who view the dashboard, potentially leading to unauthorized configuration changes or data theft in monitoring environments.

How an attack unfolds

An attacker with permission to create external links crafts a POST request to links.php containing a title field with embedded script tags. The payload is saved to the database and executed in the browser of any user who loads index.php, allowing session token theft or actions on behalf of the victim.

How to fix it

Upgrade Cacti to version 1.2.28 or apply the fix from commit f9a7cd3d76d0a5d09cff753f9c4bb5fd26c2104c. No workarounds exist.

How to confirm the fix worked

Confirm the installed version is 1.2.28 or later, or verify the commit f9a7cd3d76d0a5d09cff753f9c4bb5fd26c2104c is present. Re-test link creation with a benign script payload to ensure it is escaped on index.php.

Typical attack path

1. Obtain an account with external link creation privileges
2. Send a crafted HTTP POST to links.php with a malicious title parameter
3. Wait for or lure a privileged user to load index.php
4. Script executes in the victim's browser context to exfiltrate cookies or perform unauthorized actions

How to detect it

Inspect web server access logs and application logs for POST requests to links.php containing script-related patterns in the title field; review database entries for external links that contain HTML or script tags.

What your security team should do

• Immediately upgrade all Cacti instances to the fixed commit or 1.2.28
• Review and restrict which accounts can create external links
• Monitor web application logs for unusual title parameter values containing script tags