Here is the transformed explanation document:

---

CVE‑2022‑46169 – Explanation & Project Overview

Cacti Unauthenticated Remote Code Execution

---

What is this project?

This project is a cybersecurity assignment demonstrating CVE‑2022‑46169: a critical vulnerability in the open-source network monitoring platform Cacti (versions ≤ 1.2.22). The vulnerability allows an unauthenticated attacker to execute arbitrary OS commands on the server — without any login.

The goal of this project is to understand the vulnerability, reproduce it in a controlled lab environment, and demonstrate its impact.

---

What is CVE‑2022‑46169?

CVE‑2022‑46169 is a combination of two flaws in Cacti:

1. Authorization bypass

The remote_agent.php file should normally only be accessed by the Cacti server itself. However, the authentication check blindly trusts the X-Forwarded-For HTTP header, which can be set by the attacker. This allows anyone to pretend to be the server itself — without a password.

2. Command injection

The poller_id parameter from the URL is directly inserted into a shell command via PHP's proc_open() without validation. An attacker can therefore execute their own commands through the web server.

Combined result: a completely unauthenticated attacker can execute arbitrary commands on the server — also known as Remote Code Execution (RCE).

---

Why is this serious?

An attacker only needs to know the IP address of a vulnerable Cacti installation. No account or social engineering is required.

---

How does the exploit work concretely?

The attacker sends one HTTP request to remote_agent.php with:

• A forged X-Forwarded-For header → bypass of authentication
• A poller_id containing an embedded shell command via ; → command injection

The server executes this command as the www-data user (the Apache web server user). In practice, an attacker can use this to open a reverse shell, for example, and gain full access to the server.

---

Project structure

• docs/ — Report, screenshots and notes for the assignment.
• isos/ — VM images or container assets with the vulnerable Cacti installation.

---

Assignment framework

This project is part of a cybersecurity exercise focusing on:

• Understanding the technical workings of a real CVE
• Safely reproducing a vulnerability in an isolated lab environment
• Demonstrating the impact via a proof-of-concept
• Comparing the vulnerable system with the patched version

⚠️ Disclaimer: This project is intended solely for educational purposes in a controlled, isolated lab environment. Never use exploits on systems without explicit permission.

---

References

• NVD – CVE‑2022‑46169
• GitHub Advisory GHSA‑6p93‑p743‑35gf
• Red Hat Security Advisory
• Vulnerable Docker image by m3ssap0