CVE-2024-43364
Published: 07 October 2024
Summary
CVE-2024-43364 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Cacti Cacti. Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Cacti, an open source performance and fault management framework, contains a stored cross-site scripting vulnerability tracked as CVE-2024-43364 and CWE-79. The title parameter supplied when saving external links via links.php is not sanitized before storage in the database and is later reflected without escaping on index.php, allowing script injection.
Users holding the privilege to create external links can exploit the flaw by crafting a malicious title value in the HTTP POST request to links.php. The injected payload is persisted and executes in the browsers of other users who view the affected page, producing a stored XSS impact rated at CVSS 5.7 with network attack vector, low complexity, and high availability consequences.
The GitHub security advisory GHSA-fgc6-g8gc-wcg5 and the Debian LTS announcement state that the issue is resolved in Cacti 1.2.28 and that no workarounds exist, directing all users to upgrade. The associated EPSS score reached a peak of 0.0754 after disclosure before settling at the current value of 0.0529.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40252
Vulnerability details
Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in…
more
index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables JavaScript execution in victim browsers (T1059.007), exploitation of a web management application (T1190), application-level DoS via injected payloads (T1499.004), and impairment of the monitoring tool's usability (T1562.001).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.