Bug 1224232 (CVE-2024-29895)

Summary: VUL-0: CVE-2024-29895: cacti: command injection in cmd_realtime.php
Product: [openSUSE] openSUSE Distribution Reporter: SMASH SMASH <smash_bz>
Component: SecurityAssignee: Andreas Stieger <Andreas.Stieger>
Status: RESOLVED INVALID QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: camila.matos
Version: Leap 15.6   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/405105/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-05-14 18:06:08 UTC 
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29895
https://www.cve.org/CVERecord?id=CVE-2024-29895
https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/cmd_realtime.php#L119
https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c683d
https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c8fc
https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m
Comment 3 Camila Camargo de Matos 2024-05-14 18:14:42 UTC 
Affected versions are 1.3.x only. Package cacti is not affected in any openSUSE codestream. Therefore, I will be closing the bug.