After building the container, we can access to Cacti by browsing to http://localhost:80. The next step is to update Cactii to version 1.2.24. You can download the upgrade script here: https://pastebin.com/NfRiHLjR. Save the file at the same directory with the docker-compose.yml file and rename it to upgrade_cacti.sh. Then run these 2 commands:

Now we're good to go, let's dive into the code to see what happened that allows us to have a SQL injection attack. The vulnerable file is graph_view.php and we only need guest user to access to this file, leading to allow everyone to exploit this vulnerability. In this file, the insecure function is grow_right_pane_tree().

Before, we dive deeply into this function, we need to trace backwards to know how the functions is executed.

From above code snippet, we can see that the function will be executed if $tree_id > 0. All the step can be explained as below:

• First, the program will take the value of action parameter from user's input and step in a switch/case statement.

• In the case tree_content, the code will take the request parameter node from user. Next, it will split the input by the - character, save to $part and finally check if tree_anchor appears in node. If all conditions match, $tree_id will be assign as the second element in $part. For example, tree_content-1 or 1-2-tree_content will be valid and the value of $tree_id will be respectively.

From this point, our URL will look like this: http://localhost:80?action=tree_content&node=tree_anchor-1. Now it's time to analyze the grow_right_pane_tree() function to exploit the bug.

The vulnerable parameter is rfilter which is directly passed into the RLIKE operand inside WHERE clause. What make it vulnerable is that rfilter is wrap between the double quote ", yet the parameter is checked by the html_validate_tree_vars() function, which looks like this:

The filter type of rfilter is set to FILTER_VALIDATE_IS_REGEX and stored inside $filters, then $filter is passed into validate_store_request_vars() function. Let's dive into this function, this will reveal the rest of our analysis:

The validate_store_request_vars() function is responsible for validating user input. When the filter type is FILTER_VALIDATE_IS_REGEX, the function calls the validate_is_regex() function with the preg_match function to verify if our input is valid. According to PHP documentation:

preg_match() returns 1 if the pattern matches given subject, 0 if it does not, or false on failure.

The if statement use Strict comparison meaning that only when error occurs that we cannot step into the if statement. The $regex, which is our input, is wrapped between two single quote '. The intention of the developers is to avoid user inject the single quote ', which is often used to start a SQL injection attack. This seems to be a robust security implementation, yet let's have a look one more time again on how the rfilter is passed into the WHERE clause:

Ah-oh, The effort of validating user's input become meaningless as the rfilter is wrapped inside the double quotes ", which allows attackers to easily injection " to break out of the statement.

Having understood why it is vulnerable, now we will go deeper to the query where $sql_where is passed into.

After $sql_where is assigned, the program will call the get_allowed_tree_header_graphs() function. The function will look like this:

This is where the $sql_where is passed into a query. Note that the variable is assigned 2 more times before being passed in, which are $sql_where = " AND ($sql_where)"; and $sql_where = "WHERE (gti.graph_tree_id=$tree_id AND gti.parent=$leaf_id)" . $sql_where;. Combine with the first assignment, this is how the $sql_where is finally created:

After these 3 assignments, the $sql_where will look like this:

The query that $sql_where is passed into looks overwhelming, yet we can create another simple query with similar structure:

select * from users WHERE (TRUE) AND ((username RLIKE "' get_request_var('rfilter') '" -- something behind that isn't neccessary))

In order to successfully inject our payload, we need to break out of the " and )). Therefore, this payload may work "));SELECT SLEEP(5) --. Our payload will look like this, select * from users WHERE (TRUE) AND **((username RLIKE "'"));SELECT SLEEP(5) --. Looks good! Let's try on Cacti

The reason the server doesn't sleep for 2 seconds is because we caused error in the preg_match() function. Let's look at the function again

This function will take our input as regular expression. And the ) is used to group a set of characters. Because it's not closed, so the function returned error. On the other hand, if we try "(());SELECT SLEEP(5) --, we cannot break out of the (( from the SQL query. However, there a trick here, and it's is "OR"(("));SELECT SLEEP(5) --. Let me explain this, I wrap (( in double quote to make it as a string in SQL query and use OR to match with the username before it. The, double quote " in regular expression, however, is just considered as a normal character, that's why we can take advantage of this feature to break out of the SQL query.

Based on the response time, we can make sure that we successfully injected SQL into the database. This is a critical SQL injection vulnerability. The attacker can leverage this bug to take over admin account or even execute command remotely.

Mitigation

As usual, injection vulnerabilities in general occur due to the absence of input validation. However, in this case, the developers applied validations, yet improperly. In order to fix this, we just simply wrap the rfilter parameter inside the single quote ' instead of double quote "

With this simple fix, the effort of validating user's input will now work properly. Let's try the payload again to see if it's still vulnerable.

With the same payload but now the response is really fast, meaning that we cannot inject SQL command anymore.

From this CVE analysis, we can learn that even minor mistake can also result in a catastrophic outcome. We should carefully review the code and frequently test our website to make it more and more secure. This is the end of the analysis, hope you learnt something useful today. Happy hacking!