Cacti Security Architecture Refactoring: SSH/XSS/SSRF Fixes via Centralized Guards

Vulnerability Overview This webpage screenshot describes a security fix pull request (PR #7054) for the Cacti project, aiming to eliminate root-level vulnerability categories by introducing architectural security helper functions. The changes primarily involve the following nine security architecture components: 1. : A centralized shell execution gateway supporting parameter arrays, parameter escaping, timeout support, and credential logging. 2. : SSRF-safe HTTP fetching, supporting blocked IP lists, TLS validation, and redirect prevention. 3. : Prevention of LDAP filter injection via parameter substitution using . 4. : Requests sorting, request ID retrieval, and for secure extraction of request parameters. 5. : A declarative action scheduler that enforces HTTP methods, domains, and object ACLs. 6. XSS Fixes: Resolved issues in and where failed to escape description outputs. 7. : Privilege change mechanisms including session regeneration, lock checks, and password rotation. 8. : A CSRF protection migration plan (short-term/medium-term/long-term). 9. : Application of PHPStan Level 5 static analysis to security gateway files. Scope of Impact Core Functions: Involves core functional modules of Cacti, including shell execution, HTTP request processing, LDAP filters, action scheduling, XSS protection, and session management. Security Architecture: Reduces the attack surface and enhances overall security by introducing centralized security helper functions. Production Environments: Fixes critical security vulnerabilities present in production environments, such as path validation, DNS handling, and hostname verification. Remediation Plan 1. Centralized Security Gateways: - Introduces as a centralized shell execution gateway. - Introduces as an SSRF-safe HTTP fetch gateway. 2. LDAP Filter Injection Prevention: - Uses for parameter substitution to prevent LDAP filter injection. 3. Secure Extraction of Request Parameters: - Implements secure extraction of request parameters in . 4. Action Scheduler: - Implements a declarative action scheduler in that enforces HTTP methods, domains, and object ACLs. 5. XSS Protection: - Fixes issues in and where did not escape description outputs. 6. Session Management: - Implements session regeneration, lock checks, password rotation, and other privilege change mechanisms in . 7. CSRF Protection Migration: - Provides a CSRF protection migration plan, including short-term, medium-term, and long-term measures. 8. Static Analysis: - Applies PHPStan Level 5 static analysis to security gateway files to enhance code security. 9. Other Fixes: - Fixes critical security vulnerabilities in production environments, such as path validation, DNS handling, and hostname verification. POC Code or Exploit Code No specific POC code or exploit code is provided on the page. --- The above summary is based on the content in the webpage screenshot, covering the vulnerability overview, scope of impact, and remediation plan.

Goal Reached Thanks to every supporter — we hit 100%!

Cacti Security Architecture Refactoring: SSH/XSS/SSRF Fixes via Centralized Guards

More from this source