CVE-2024-25641 PoC — Cacti RCE vulnerability when importing packages

Source

https://github.com/StopThatTalace/CVE-2024-25641-CACTI-RCE-1.2.26

Associated Vulnerability

Title: Cacti RCE vulnerability when importing packages (CVE-2024-25641)
Description:Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.

Description

Fully automated PoC - CVE-2024-25641 - RCE - Cacti < v1.2.26 🌵

Readme

# CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵

- [x] `Authenticated RCE`
- [x] `Cacti version < v1.2.26`

## Summary
___

An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server (RCE).


## Proof Of Concept
___

![CVE DEMO](https://github.com/user-attachments/assets/1ee4800b-4fc1-4bf4-8b7a-a4e5999143e9)

## Usage
___

```
git clone https://github.com/StopThatTalace/CVE-2024-25641-CACTI-RCE-1.2.26.git && cd CVE-2024-25641-CACTI-RCE-1.2.26

pip install -r requirements.txt

python3 CVE-2024-25641.py http://localhost/path/to/cacti/ --user admin --pass admin123 -x 'whoami'
```

### With poetry
```
git clone https://github.com/StopThatTalace/CVE-2024-25641-CACTI-RCE-1.2.26.git && cd CVE-2024-25641-CACTI-RCE-1.2.26

poetry install

poetry run python3 CVE-2024-25641.py http://localhost/path/to/cacti/ --user admin --pass admin123 -x 'whoami'
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →