https://bugzilla.suse.com/show_bug.cgi?id=1224232 Bug ID: 1224232 Summary: VUL-0: CVE-2024-29895: cacti: command injection in cmd_realtime.php Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405105/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Andreas.Stieger@gmx.de Reporter: smash_bz@suse.de QA Contact: security-team@suse.de CC: camila.matos@suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29895 https://www.cve.org/CVERecord?id=CVE-2024-29895 https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18... https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c68... https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c8... https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m -- You are receiving this mail because: You are on the CC list for the bug.