CVE-2024-34340: Cacti Authentication Bypass Vulnerability

CVE-2024-34340 Overview

CVE-2024-34340 is an authentication bypass vulnerability affecting Cacti, a widely-used operational monitoring and fault management framework. The vulnerability exists in the compat_password_verify function, which uses a loose comparison operator (==) instead of strict comparison (===) when verifying MD5-hashed passwords. This type juggling vulnerability allows attackers to potentially bypass authentication mechanisms by exploiting PHP's loose type comparison behavior, leading to unauthorized access to the Cacti monitoring platform.

Critical Impact
Attackers can bypass authentication controls on vulnerable Cacti installations, potentially gaining unauthorized administrative access to monitoring infrastructure and the ability to view sensitive network data or execute privileged operations.

Affected Products

Cacti versions prior to 1.2.27
Fedora 39 (with vulnerable Cacti packages)

Discovery Timeline

2024-05-14 - CVE CVE-2024-34340 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-34340

Vulnerability Analysis

This vulnerability stems from improper authentication implementation in Cacti's password verification logic. When users set their password, Cacti calls the compat_password_hash function, which utilizes PHP's native password_hash function if available, otherwise falling back to MD5 hashing. The critical flaw exists in the compat_password_verify function used during login verification.

On PHP versions below 5.5.0 (or systems where password_verify is unavailable), the verification logic falls back to comparing MD5 hashes. The vulnerable code compares the user-supplied MD5-hashed input with the stored password hash using PHP's loose comparison operator (==). This enables type juggling attacks where specially crafted inputs can match password hashes due to PHP's automatic type coercion during comparisons.

The vulnerability is classified under CWE-287 (Improper Authentication) and CWE-697 (Incorrect Comparison), reflecting both the authentication bypass impact and the root cause in flawed comparison logic.

Root Cause

The root cause is the use of PHP's loose comparison operator (==) instead of the strict comparison operator (===) in the compat_password_verify function. When comparing MD5 hashes, PHP's loose comparison can lead to unexpected true results if the hash values begin with specific patterns (such as 0e followed by digits, which PHP interprets as scientific notation evaluating to zero). This allows attackers to craft inputs that produce hash values which loosely equal legitimate password hashes through type juggling.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a Cacti installation running a vulnerable version (prior to 1.2.27)
Determining that the target uses MD5-based password hashing (legacy PHP environment)
Crafting authentication requests with specially selected password values that produce MD5 hashes triggering PHP type juggling
Bypassing authentication when the loose comparison evaluates to true against stored password hashes that have exploitable patterns

The vulnerability mechanism relies on PHP interpreting certain string patterns as scientific notation. For example, an MD5 hash starting with 0e followed only by digits (like 0e462097431906509019562988736854) is interpreted as 0^462097431906509019562988736854 which equals 0 when evaluated numerically. If both the stored hash and attacker-supplied hash value trigger this behavior, the loose comparison == returns true despite the actual password being different.

Detection Methods for CVE-2024-34340

Indicators of Compromise

Unusual or unexpected authentication successes in Cacti access logs
Login events from unrecognized IP addresses or geographic locations
Multiple failed authentication attempts followed by successful logins without valid credentials
Suspicious administrative actions performed by accounts with weak or unknown passwords

Detection Strategies

Monitor Cacti authentication logs for anomalous login patterns, particularly rapid authentication attempts with varying password inputs
Implement Web Application Firewall (WAF) rules to detect potential type juggling payloads in authentication requests
Deploy intrusion detection signatures looking for authentication bypass attempts against Cacti endpoints
Review and audit user accounts for unauthorized access or privilege changes

Monitoring Recommendations

Enable detailed authentication logging in Cacti and forward logs to a centralized SIEM platform
Set up alerts for successful authentications from previously unseen source IPs
Monitor for configuration changes or data exports following authentication events
Implement baseline analysis to detect anomalous user behavior patterns post-authentication

How to Mitigate CVE-2024-34340

Immediate Actions Required

Upgrade Cacti to version 1.2.27 or later immediately
Review authentication logs for evidence of exploitation prior to patching
Reset passwords for all Cacti user accounts, particularly administrative accounts
Restrict network access to Cacti instances using firewall rules or VPN requirements
Verify PHP version and ensure modern password hashing functions are available

Patch Information

Cacti version 1.2.27 contains the official patch for this vulnerability. The fix replaces the loose comparison operator (==) with the strict comparison operator (===) in the compat_password_verify function, eliminating the type juggling attack vector. Security advisories and patch details are available in the Cacti GitHub Security Advisory. Additional distribution-specific updates are available through the Fedora Package Announcement and Debian LTS Announcement.

Workarounds

Restrict access to Cacti web interface to trusted internal networks only using firewall rules
Implement multi-factor authentication (MFA) in front of Cacti access where possible
Deploy a reverse proxy with additional authentication requirements
Ensure PHP environment uses version 5.5.0 or later where native password_hash and password_verify functions are available, bypassing the vulnerable MD5 fallback code path
Monitor authentication attempts closely until patching is complete