CVE-2024-29895: Cacti command injection in cmd_realtime.php
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used as part of the command execution is sourced from $SERVER['argv'], which can be controlled by URL when registerargcargv option of PHP is On. And this option is On by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29895?
CVE-2024-29895 is considered a critical vulnerability due to its potential for command injection by unauthenticated users.
How do I fix CVE-2024-29895?
To fix CVE-2024-29895, upgrade to the latest version of Cacti where the vulnerability has been addressed.
Who is affected by CVE-2024-29895?
CVE-2024-29895 affects Cacti versions from 1.3.0 onwards when the PHP `register_argc_argv` option is enabled.
Can CVE-2024-29895 be exploited remotely?
Yes, CVE-2024-29895 can be exploited remotely by any unauthenticated user with access to the vulnerable Cacti instance.
What is the impact of CVE-2024-29895?
The impact of CVE-2024-29895 allows attackers to execute arbitrary commands on the server, leading to potential server compromise.