Bug 2280495 (CVE-2024-29894)

Summary:	CVE-2024-29894 cacti: XSS vulnerability when using JavaScript based messaging API
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cacti 1.2.27	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2280496, 2280497
Bug Blocks:

Description Robb Gatica 2024-05-15 00:14:54 UTC

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue.

https://github.com/Cacti/cacti/security/advisories/GHSA-grj5-8fcj-34gh
https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73

Comment 1 Robb Gatica 2024-05-15 00:15:10 UTC

Created cacti tracking bugs for this issue:

Affects: epel-all [bug 2280496]
Affects: fedora-all [bug 2280497]