CVE-2024-31445: Cacti SQL Injection Vulnerability

CVE-2024-31445 Overview

Cacti is an open-source operational monitoring and fault management framework used to collect, store, and graph time-series data from network devices. CVE-2024-31445 is a SQL injection vulnerability [CWE-89] in the automation_get_new_graphs_sql function inside lib/api_automation.php. Authenticated users can inject SQL statements through the filter request variable, which is concatenated into a query without sanitization. Successful exploitation leads to privilege escalation and remote code execution on the Cacti host. All Cacti versions prior to 1.2.27 are affected, along with the Fedora 39 package that shipped the vulnerable release.

Critical Impact
Authenticated attackers can escalate privileges and execute arbitrary code on the Cacti server by injecting SQL through the filter parameter.

Affected Products

Cacti versions prior to 1.2.27
Fedora 39 (cacti package)
Debian LTS distributions shipping affected Cacti packages

Discovery Timeline

2024-05-14 - CVE-2024-31445 published to the National Vulnerability Database (NVD)
2024-05-14 - GitHub Security Advisory GHSA-vjph-r677-6pcc published by the Cacti project
2024-09 - Debian LTS security update released (Debian LTS Announcement)
2026-06-17 - Last modified in the NVD database

Technical Details for CVE-2024-31445

Vulnerability Analysis

The vulnerability resides in lib/api_automation.php within the automation_get_new_graphs_sql function. At line 856, the value returned by get_request_var('filter') is concatenated directly into a SQL HAVING clause using a LIKE "%...%" pattern. At line 717, the request variable is registered with FILTER_DEFAULT, meaning no server-side sanitization is applied to the input before it reaches the query builder.

Because the affected code path builds a dynamic HAVING clause across attacker-influenced column names, an authenticated user with access to the automation graph filter UI can break out of the string literal and append arbitrary SQL. Cacti runs the resulting query with the database privileges of the application user, which typically has full read and write access to the cacti schema. Vendors of Cacti have documented that SQL injection in this component can be chained to privilege escalation and remote code execution because attackers can modify configuration and poll data used by downstream shell operations.

Root Cause

The root cause is unsafe string concatenation of user-controlled input into a SQL statement combined with the use of FILTER_DEFAULT, which performs no character filtering. The filter parameter is neither escaped with db_qstr() nor bound as a prepared-statement parameter before use in the LIKE expression.

Attack Vector

Exploitation requires an authenticated Cacti session but no user interaction. The attacker submits a crafted filter value to the automation endpoint that invokes automation_get_new_graphs_sql, terminating the enclosing LIKE string and appending SQL such as UNION SELECT payloads or stacked queries to alter Cacti configuration tables used for command execution.

php

// Patch applied in lib/api_automation.php (fd93c6e)
$i = 0;

foreach ($field_names as $column) {
-    $sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE "%' . $filter . '%"';
+    $sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE ' . db_qstr('%' . $filter . '%');
    $i++;
}

Source: Cacti commit fd93c6e. The fix replaces raw concatenation with db_qstr(), which safely quotes and escapes the value before it is embedded in the SQL statement.

Detection Methods for CVE-2024-31445

Indicators of Compromise

Web server access logs containing SQL metacharacters (', ", --, UNION, SELECT) in the filter query string on Cacti automation endpoints such as automation_graphs.php
Unexpected writes to Cacti tables including settings, poller_command, or data_input from the application database user
New or modified data input methods that reference shell commands not deployed by an administrator
Cacti cmd.php or poller processes spawning shells with arguments not tied to legitimate device polling

Detection Strategies

Alert on HTTP requests to Cacti automation endpoints where the filter parameter contains SQL keywords or comment sequences.
Correlate authenticated Cacti sessions with database audit logs showing DDL or writes to configuration tables outside of upgrade windows.
Monitor process ancestry on the Cacti host for php-fpm or apache child processes launching sh, bash, or scripting interpreters.

Monitoring Recommendations

Enable MySQL/MariaDB general or audit logging on the Cacti database and forward events to a central SIEM for query pattern analysis.
Track Cacti application logs (cacti.log) for authentication events followed by automation graph filter usage from the same session.
Baseline the Cacti version reported by /cacti/version and alert when hosts remain below 1.2.27.

How to Mitigate CVE-2024-31445

Immediate Actions Required

Upgrade Cacti to version 1.2.27 or later on all instances, including development and staging environments.
Apply distribution updates for Fedora 39 and Debian LTS packages that ship the patched Cacti release.
Rotate credentials for any Cacti user accounts and the underlying database account if exploitation is suspected.
Review Cacti data_input methods and settings records for unauthorized modifications introduced through SQL injection.

Patch Information

The upstream fix is commit fd93c6e, included in Cacti 1.2.27. Details are published in the GitHub Security Advisory GHSA-vjph-r677-6pcc. Downstream fixes are available in the Fedora package announcement and the Debian LTS announcement.

Workarounds

Restrict access to the Cacti web interface with network ACLs or a reverse proxy that requires additional authentication until patching completes.
Limit Cacti user accounts to the minimum roles required and remove access to automation features for non-administrative users.
Place a web application firewall rule in front of Cacti to block SQL metacharacters in the filter parameter of automation endpoints.

bash

# Verify installed Cacti version and upgrade on Debian/Ubuntu
dpkg -l | grep -i cacti
sudo apt-get update && sudo apt-get install --only-upgrade cacti

# Verify installed Cacti version and upgrade on Fedora
rpm -q cacti
sudo dnf upgrade --refresh cacti

# Confirm the running application version
grep "cacti_version" /usr/share/cacti/include/cacti_version