CVE-2024-25641 PoC — Cacti RCE vulnerability when importing packages

Source

https://github.com/Safarchand/CVE-2024-25641

Associated Vulnerability

Title:Cacti RCE vulnerability when importing packages (CVE-2024-25641)
Description:Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.

Description

PoC for CVE-2024-25641 Authenticated RCE on Cacti v1.2.26

Readme

# Cacti CVE-2024-25641 Authenticated Package Upload RCE Proof of Concept (PoC)

This script is a Proof of Concept (PoC) for exploiting the CVE-2024-25641 vulnerability in Cacti, a web-based monitoring tool. The script automates the process of authenticating with the application, uploading a malicious package, and triggering a reverse shell.

## Requirements

- Python 3.x
- `requests` library
- `argparse` library
- `re` library

You can install the required Python library using pip3:

```bash
pip3 install requests
pip3 install argparse
pip3 install re
```

## Usage
(make sure to place the **test.xml.gz** in the same directory as the **exploit.py**)

```bash
python3 exploit.py --url <TARGET_URL> -u <USERNAME> -p <PASSWORD> -i <LOCAL_IP> -l <PORT> [--proxy]
```

## Start nc listener

```bash
nc -nvlp <port>
```

File Snapshot


 [4.0K]  /data/pocs/a0c63c189ba073129de9924b1a31ea3bebf8670c
├── [4.2K]  exploit.py
├── [ 820]  README.md
└── [1.1K]  test.xml.gz

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!