CVE-2023-30534
published 2023-09-05CVE-2023-30534: Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24…
PriorityP430medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EXPLOIT
EPSS
2.57%
83.2th percentile
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cacti | cacti | < 1.2.25 | 1.2.25 |
| cacti | cacti | >= 0 < 1.2.25+ds1-1 | 1.2.25+ds1-1 |
| cacti | cacti | >= 0 < 1.2.25+ds1-1 | 1.2.25+ds1-1 |
| debian | cacti | < cacti 1.2.25+ds1-1 (forky) | cacti 1.2.25+ds1-1 (forky) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor POST requests to graphs_new.php targeting the host_new_graphs_save function for unsanitized serialized PHP objects in user-supplied parameters. ↗
- ·Fixed in Cacti 1.2.25; Debian packages fixed in 1.2.25+ds1-1 for forky, sid, and trixie — bookworm and bullseye remain open. ↗
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-30534: Cacti is an open source operational monitoring and fault management framework
osv·2023-09-05·CVSS 4.3
CVE-2023-30534 [MEDIUM] CVE-2023-30534: Cacti is an open source operational monitoring and fault management framework
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised
Debian
CVE-2023-30534: cacti - Cacti is an open source operational monitoring and fault management framework. T...
vendor_debian·2023·CVSS 4.3
CVE-2023-30534 [MEDIUM] CVE-2023-30534: cacti - Cacti is an open source operational monitoring and fault management framework. T...
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised
No detection rules found.
Nuclei
Cacti < 1.2.25 Insecure Deserialization
nuclei·CVSS 4.3
CVE-2023-30534 [MEDIUM] Cacti < 1.2.25 Insecure Deserialization
Cacti \\s*([\\s\\S]*unserialize[\\s\\S]*managers.php[\\s\\S]*[Aa]uthenticated)"
condition: and
- type: status
status:
- 200
extractors:
- type: regex
name: csrf_token
part: body
group: 1
regex:
- "var csrfMagicToken = ['\"]([a-z0-9,:;]*)['\"]"
internal: true
# digest: 4a0a00473045022054312457c3d362bb5bfb309e7867b53d278d10b38d1223e7449028ff52f76ace02210081b13d2e912e7e8ca187424e99ffe3f9ca07d1fc9868e58d57f9f6ca85590c48:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
https://github.com/Cacti/cacti/security/advisories/GHSA-77rf-774j-6h3phttps://lists.fedoraproject.org/archives/list/[email protected]/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/https://lists.fedoraproject.org/archives/list/[email protected]/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/https://lists.fedoraproject.org/archives/list/[email protected]/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/https://www.fastly.com/blog/cve-2023-30534-insecure-deserialization-in-cacti-prior-to-1-2-25https://github.com/Cacti/cacti/security/advisories/GHSA-77rf-774j-6h3phttps://lists.fedoraproject.org/archives/list/[email protected]/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/https://lists.fedoraproject.org/archives/list/[email protected]/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/https://lists.fedoraproject.org/archives/list/[email protected]/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/https://www.fastly.com/blog/cve-2023-30534-insecure-deserialization-in-cacti-prior-to-1-2-25
2023-09-05
Published