CVE-2024-29895
"Cacti Command Injection Vulnerability"
Description
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
INFO
Published Date :
May 14, 2024, 3:17 p.m.
Last Modified :
Nov. 21, 2024, 9:08 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
6.0
Exploitability Score :
3.9
Public PoC/Exploit Available at Github
CVE-2024-29895 has a 8 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-29895.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2024-29895-CactiRCE-PoC , RCE, POC, CVE-2024-29895
cve-2024-29895 poc rce-exploit cve-2024-29895-cactirce-poc
Python
CVE-2024-29895 | RCE on CACTI 1.3.X dev
Python
None
Python
Cacti CVE-2024-29895 POC
Rust
CVE-2024-29895 PoC - Exploiting remote command execution in Cacti servers using the 1.3.X DEV branch builds
0day cacti cve-2024 owasp php rce cactirce cve-2024-29895
Python
A list of dorks for the Netlas.io search engine, with which you can find millions of objects in the boundless IoE. Contains queries to search for IoT elements, protocols, communication tools, remote access, and more. Over time, the list will grow.
osint penetration-testing security-tools
Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.
cisa-kev vulnerability 0day cisa exploits
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-29895 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-29895 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/cmd_realtime.php#L119 Added Reference https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c683d Added Reference https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c8fc Added Reference https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m -
CVE Received by [email protected]
May. 14, 2024
Action Type Old Value New Value Added Description Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc. Added Reference GitHub, Inc. https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m [No types assigned] Added Reference GitHub, Inc. https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c683d [No types assigned] Added Reference GitHub, Inc. https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c8fc [No types assigned] Added Reference GitHub, Inc. https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/cmd_realtime.php#L119 [No types assigned] Added CWE GitHub, Inc. CWE-77 Added CVSS V3.1 GitHub, Inc. AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-29895 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-29895
weaknesses.