Bug 1082122 (CVE-2014-2326, CVE-2014-2327, CVE-2014-2328)

A posting to bugtraq from Deutsche Telekom [1] noted multiple flaws in Cacti 0.8.7g:

CVE-2014-2326: stored XSS
"The Cacti application is susceptible to stored XSS attacks. This is mainly the result of improper output encoding."

CVE-2014-2327: missing CSRF token
"The Cacti application does not implement any CSRF tokens. More about CSRF attacks, risks and mitigations see https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF). This attack has a vast impact on the security of the Cacti application, as multiple configuration parameters can be changed using a CSRF attack. One very critical attack vector is the modification of several binary files in the Cacti configuration, which may then be executed on the server. This results in full compromise of the Cacti host by just clicking a web link. A proof of concept exploit has been developed, which allows this attack, resulting in full (system level) access of the Cacti system. Further attack scenarios include the modification of the Cacti configuration and adding arbitrary (admin) users to the application."

CVE-2014-2328: use of exec-like function calls without safety checks allow arbitrary command execution
"Cacti makes use of exec-like method PHP function calls, which execute command shell code without any safety checks in place. In combination with a CSRF weakness this can be triggered without the knowledge of the Cacti user. Also, for more elaborate attacks, this can be combined with a XSS attack. Such an attack will result in full system (Cacti host) access without any interaction or knowledge of the Cacti admin."


Unfortunately, they provided no further information, so it's impossible to know whether or not Cacti 0.8.8b, which is the version currently shipped in Fedora and EPEL, is affected by these flaws as there is no way to validate or test based on the above descriptions.  Hopefully they provided further information to upstream, but as of yet there are no available patches upstream.

As a result I'm not filing any Fedora/EPEL trackers until we actually know what the flaws are.  More worrisome is that they found these flaws in 0.8.7g but that version is about 3 years old...

[1] http://www.securityfocus.com/archive/1/531588