CVE-2024-31459 Overview
Cacti is an open-source operational monitoring and fault management framework used by network administrators to graph time-series metrics. CVE-2024-31459 is a file inclusion vulnerability in the api_plugin_hook() function within lib/plugin.php. The function reads plugin metadata from the plugin_hooks and plugin_config database tables and concatenates that data directly into a file path used for inclusion. When combined with SQL injection vulnerabilities in earlier Cacti releases, authenticated attackers can achieve remote code execution. Versions prior to 1.2.27 are affected, and the maintainers shipped a fix in 1.2.27.
Critical Impact
An authenticated attacker who can influence the plugin_hooks or plugin_config tables can force Cacti to include an attacker-controlled PHP file, resulting in remote code execution on the monitoring server.
Affected Products
- Cacti versions prior to 1.2.27
- Fedora 39 (cacti package)
- Debian LTS cacti package (fixed via DLA-3906)
Discovery Timeline
- 2024-05-14 - CVE-2024-31459 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-31459
Vulnerability Analysis
The vulnerability is a PHP file inclusion issue classified as [CWE-98] (Improper Control of Filename for Include/Require Statement). Cacti's plugin subsystem relies on api_plugin_hook() to dispatch hook callbacks registered by installed plugins. During dispatch, the function queries the plugin_hooks and plugin_config tables and uses fields returned from those queries to build a filesystem path. That path is then passed to a PHP include or require construct.
Because the data flows from the database directly into a filesystem operation without allowlisting or path canonicalization, an attacker who can write to those tables can control which file Cacti loads. Chained with any of the pre-existing Cacti SQL injection issues addressed in the 1.2.x branch, this primitive elevates from database write to arbitrary PHP execution under the Cacti web user.
Root Cause
The root cause is unvalidated concatenation of database-sourced strings into a file inclusion path inside api_plugin_hook(). Cacti treats plugin registration data as trusted, but that data is reachable through authenticated administrative flows and through SQL injection sinks that predate the 1.2.27 fix. The function does not restrict included files to a known plugin directory or verify filename characters.
Attack Vector
Exploitation requires network access to the Cacti web interface and privileged authentication or a chained SQL injection primitive. The attacker manipulates rows in plugin_hooks or plugin_config so that the derived path resolves to a file they control. When Cacti next invokes the plugin hook, PHP includes that file and executes its contents. The result is code execution with the privileges of the Cacti application, which typically runs as the web server user with access to monitoring credentials and stored device data.
No verified public proof-of-concept code is available in the referenced advisories. See the GitHub Security Advisory GHSA-cx8g-hvq8-p2rv for the maintainer's technical description.
Detection Methods for CVE-2024-31459
Indicators of Compromise
- Unexpected rows or modifications in the plugin_hooks and plugin_config tables that reference non-standard filenames or path traversal sequences
- New or altered PHP files inside Cacti's plugins/ directory or writable web paths not associated with a known plugin installation
- Web server processes (php-fpm, apache2, httpd) spawning shells, curl, wget, or reverse-shell utilities
- Outbound connections from the Cacti host to attacker infrastructure shortly after administrative HTTP requests
Detection Strategies
- Monitor Cacti audit logs and MySQL general/query logs for UPDATE or INSERT statements targeting plugin_hooks or plugin_config from unexpected sessions
- Alert on PHP include/require operations that resolve outside the Cacti installation root using file integrity monitoring or auditd open rules
- Compare installed Cacti version against 1.2.27 across the estate and flag any host still on a vulnerable release
Monitoring Recommendations
- Forward Cacti web server access logs, PHP error logs, and MySQL query logs to a central analytics platform for correlation
- Baseline the contents of the plugins/ directory and alert on file creation or modification by the web user
- Track child processes of the web server and generate alerts on interactive shell or scripting interpreter execution
How to Mitigate CVE-2024-31459
Immediate Actions Required
- Upgrade all Cacti instances to version 1.2.27 or later without delay
- Restrict network access to the Cacti web interface to trusted management networks only
- Rotate administrative credentials and any device credentials stored in Cacti if compromise is suspected
- Audit the plugin_hooks and plugin_config tables for unexpected entries and remove unknown rows
Patch Information
Cacti version 1.2.27 contains the fix for CVE-2024-31459 and the related SQL injection chains referenced in GHSA-cx8g-hvq8-p2rv, GHSA-gj3f-p326-gh8r, and GHSA-pfh9-gwm6-86vp. Distribution-specific updates are available via the Fedora Package Announcement and the Debian LTS Security Announcement.
Workarounds
- Place the Cacti web interface behind a reverse proxy that enforces authentication and IP allowlisting until patching completes
- Remove or disable non-essential Cacti plugins to reduce the number of hook records available for abuse
- Apply strict filesystem permissions so the web server user cannot write new PHP files into the Cacti installation directory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
