Skip to content

XSS vulnerability when managing data queries

Moderate
netniV published GHSA-rqc8-78cm-85j3 May 12, 2024

Package

Cacti (PHP)

Affected versions

<= 1.2.26

Patched versions

1.2.27

Description

Summary

Some of the data stored in form_save() function in data_queries.php is not thoroughly checked and is used to concatenate the HTML statement in grow_right_pane_tree() function from lib/html.php , finally resulting in XSS.

Details

In the SQL table snmp_query stored in database, the name field is controllable. The writing of dirty data can be done from form_save() function in data_queries.php.
image

Both writing and reading don't require administrator privileges, so the impact of this XSS vulnerability is relatively significant.
Writing: section13 from data_queries.php: template editor - data queries
image

Reading: section7 from graph_view.php : normal user - graph
image

The attack starts in graph_view.php. and calls form_confirm() function.
image

Finally arriving at lib/html_tree.php and reading field name in snmp_query. Variable $host_group_data_name is not checked and concatenated directly, resulting in XSS.
image
image
image

PoC

POST access data_queries.php and submit the following data:

            'id'=>'2',
            'action'=>'save',
            'save_component_snmp_query'=>1,
            'name'=>"dp:<script>alert(1);</script>",
            'description'=>"control",
            'xml_path'=>"control",
            'data_input_id'=>'1',

check field in snmp_query table.
image

GET access : "http://ip:port/graph_view.php?action=tree_content&node=test-1-tbranch&hgd=dq:2".
image

Researcher: ISHGARD-2, USTC

Severity

Moderate
5.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVE ID

CVE-2024-31443

Weaknesses

No CWEs

Credits