CVE-2024-43363 Overview
Cacti is an open source performance and fault management framework used to graph network and system metrics. CVE-2024-43363 is a code injection vulnerability [CWE-94] that allows an authenticated administrator to achieve remote code execution (RCE) through log poisoning. An attacker creates a device with a malicious hostname containing PHP code, then abuses step 5 of the installation process to redirect the Cacti log file to a .php path. Requesting the poisoned log file executes the injected PHP. The issue affects Cacti versions prior to 1.2.28.
Critical Impact
Authenticated administrators can execute arbitrary commands on the underlying host, compromising monitoring infrastructure and any credentials or network data collected by Cacti.
Affected Products
- Cacti Cacti versions prior to 1.2.28
- Debian LTS packages tracked in the Debian LTS security advisory
- Deployments exposing the Cacti web interface to admin-privileged users
Discovery Timeline
- 2024-10-07 - CVE-2024-43363 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43363
Vulnerability Analysis
The vulnerability chains two weaknesses in Cacti. First, device hostname fields are stored without sanitizing PHP tags, allowing injected code to reach the log file when the hostname is written to logs. Second, the installer permits the log file path to be reconfigured to an arbitrary file extension, including .php, when step 5 of the installation flow is replayed.
An attacker with admin access creates a device whose hostname is a PHP payload. The polling and error logging paths write the hostname into the log. The attacker then reruns the installer to set the log file to a location served by the web server with a .php extension. Retrieving that URL executes the poisoned log as PHP, giving the attacker command execution as the web server user.
Root Cause
The root cause is improper control of code generation [CWE-94]. Cacti fails to sanitize user-controlled input written to log files and permits privileged reconfiguration of the log file path to an executable extension. Neither the hostname field nor the log path selection validates against server-side script execution.
Attack Vector
Exploitation requires network access to the Cacti web interface and administrator credentials. The attack does not require user interaction. Once an admin account is compromised or misused, the attacker can pivot to full RCE and use the host as a foothold into the monitored network.
See the GitHub Security Advisory GHSA-gxq4-mv8h-6qj4 for the maintainer's technical description.
Detection Methods for CVE-2024-43363
Indicators of Compromise
- Cacti log files with a .php extension or located inside a web-served directory
- Device records where the hostname field contains <?php, backticks, or shell metacharacters
- Web access logs showing GET requests to the Cacti log file URL followed by outbound connections from the Cacti host
- Unexpected child processes of the web server user (php-fpm, apache, www-data) spawning shells or network utilities
Detection Strategies
- Alert on modification of Cacti configuration entries that change the log file path, particularly to extensions such as .php, .phtml, or .phar
- Inspect the host table in the Cacti database for hostnames containing PHP tags or shell syntax
- Monitor the Cacti installation endpoint for repeated access to step 5 by authenticated sessions outside of an active install or upgrade
Monitoring Recommendations
- Enable file integrity monitoring on the Cacti config.php, log directory, and web root
- Forward Cacti web server access logs and PHP error logs to a centralized SIEM for correlation
- Baseline process trees of the web service account and alert on deviations such as sh, bash, curl, or wget child processes
How to Mitigate CVE-2024-43363
Immediate Actions Required
- Upgrade Cacti to version 1.2.28 or later, which addresses the log poisoning chain
- Audit all administrator accounts and rotate credentials for any suspected of compromise
- Review the configured log file path and reset it to a location outside any web-served directory
- Inspect the device inventory and remove entries with suspicious hostname values
Patch Information
The issue is fixed in Cacti 1.2.28. Debian LTS users should apply the updates described in the Debian LTS Announcement. Full technical remediation details are documented in the GitHub Security Advisory.
Workarounds
- No official workarounds exist; the advisory states upgrading is the only remediation
- Restrict administrator access to the Cacti interface using network-level controls until patching is complete
- Ensure the Cacti log directory is outside the web server document root and cannot be served over HTTP
# Verify installed Cacti version and confirm log path is not web-accessible
cacti_version=$(grep "define('CACTI_VERSION'" /var/www/html/cacti/include/cacti_version.php)
echo "$cacti_version"
# Confirm log file path is outside the web root
grep -E "log_path|path_cactilog" /var/www/html/cacti/include/config.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
