Most internet-exposed Cacti servers exposed to hacking

guest · Jan 15, 2023

By Pierluigi Paganini - January 14, 2023

Cacti is an open-source platform that provides a robust and extensible operational monitoring and fault management framework for users.

Researchers from Censys discovered that the majority of internet-exposed Cacti servers are vulnerable to the critical flaw CVE-2022-46169 which is under active exploitation in the wild.
Click to expand...

The flaw is a command injection vulnerability that can be exploited by an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The flaw resides in the `remote_agent.php` file that can be accessed by any unauthenticated user. The vulnerability affects versions 1.2.22 and below.

“A command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device.” reads the advisory.
Click to expand...

The vulnerability was discovered by Sonarsource researchers, who provided details about the issue and published a video PoC demonstrating the exploitation of a server running a vulnerable version of Cacti:
Click to expand...

Sonarsource: Cacti: Unauthenticated Remote Code Execution

By Stefan Schiller - January 3, 2023
Cacti is an open-source, web-based monitoring solution with a long-standing history dating back to its first release in 2001. Nowadays, it is well established, actively maintained, and deployed worldwide. A quick Shodan search reveals that thousands of organizations publicly expose their instances to the internet.

This article will outline the impact and deep dive into the technical details of the discovered vulnerabilities. Furthermore, we will determine the root cause of the vulnerabilities and explain how the applied patches mitigate them.
Click to expand...

Log in or Sign up

Most internet-exposed Cacti servers exposed to hacking

guest Guest

Log in or Sign up

Most internet-exposed Cacti servers exposed to hacking

guest Guest

Useful Searches