CVE-2024-43365

What it actually does

Improper input sanitization of the consolenewsection parameter in links.php permits injection of arbitrary JavaScript that is persisted in the database and reflected without escaping on index.php, enabling stored cross-site scripting.

Why it matters to the business

Attackers can hijack authenticated sessions, exfiltrate credentials or monitoring data, and perform unauthorized actions within the performance management platform, increasing risk of lateral movement in operational environments.

How an attack unfolds

An authenticated user with external link creation rights submits a crafted POST request to links.php that embeds malicious script in the consolenewsection field; the payload is stored and later served to any user loading index.php, executing in the victim's browser context.

How to fix it

Upgrade cacti/cacti to the fixed commit f9a7cd3d76d0a5d09cff753f9c4bb5fd26c2104c (release 1.2.28). No workarounds exist; apply the update immediately given the moderate and rising EPSS score.

How to confirm the fix worked

Confirm deployment of version 1.2.28 or the listed commit, then attempt external link creation with test payloads containing script tags and verify they are rejected or escaped before storage and display.

Typical attack path

1. Obtain or compromise an account permitted to create external links
2. Craft and submit a POST to links.php containing script payload in consolenewsection
3. Confirm storage via database inspection or subsequent page loads
4. Wait for or lure a victim user to view index.php
5. Execute stolen session tokens or actions via the reflected script

How to detect it

Inspect web server access logs for POST requests to links.php that contain script or HTML tags in the consolenewsection parameter; examine database rows storing external links for unexpected markup; correlate with successful loads of index.php by non-creator accounts.

• POST /links.php.*consolenewsection=.*<script
• consolenewsection parameter containing javascript: or onerror=
• Database entries in external_links table with raw script tags

What your security team should do

• Upgrade all Cacti instances to 1.2.28 without delay
• Audit existing external links for embedded script content
• Enable web application firewall rules that block script tags in POST parameters to links.php
• Review privileged accounts and enforce least-privilege link creation rights