Cacti < 1.2.25 - Authenticated Remote Code Execution via SNMP Device Options
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2023-39362. PoCs published by Antonio Francesco Sardella, jakabakos, m3ssap0.
AI-analyzed exploit summary This exploit demonstrates an authenticated command injection vulnerability in Cacti 1.2.24 via SNMP options, allowing remote code execution by injecting malicious commands into the SNMP Community String field.
Description
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Exploits (3)
This exploit demonstrates an authenticated command injection vulnerability in Cacti 1.2.24 via SNMP options, allowing remote code execution by injecting malicious commands into the SNMP Community String field.
This repository contains a functional exploit for CVE-2023-39362, an authenticated command injection vulnerability in Cacti's SNMP options. The exploit leverages a malicious SNMP community string to achieve remote code execution on the underlying server.
This repository provides a vulnerable Dockerized Cacti v1.2.24 environment to test CVE-2023-39362, an authenticated command injection vulnerability via SNMP options. It includes detailed steps to reproduce the exploit, demonstrating RCE via crafted SNMP community strings.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H