{
  "cveId": "CVE-2022-46169",
  "url": "https://patchblox.com/security/cve/CVE-2022-46169",
  "summary": "CVE-2022-46169 is fixed in cacti on 1 platform, first by cacti 1.1.38\u002Bds1-1ubuntu0.1~esm4, released December 5, 2022. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on February 16, 2023. Patch Radar priority: Patch now.",
  "title": "cacti: Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management f...",
  "description": "Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the \u0060remote_agent.php\u0060 file. This file can be accessed without authentication. This function retrieves the IP address of the client via \u0060get_client_addr\u0060 and resolves this IP address to the corresponding hostname via \u0060gethostbyaddr\u0060. After this, it is verified that an entry within the \u0060poller\u0060 table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns \u0060true\u0060 and the client is authorized. This authorization can be bypassed due to the implementation of the \u0060get_client_addr\u0060 function. The function is defined in the file \u0060lib/functions.php\u0060 and checks serval \u0060$_SERVER\u0060 variables to determine the IP address of the client. The variables beginning with \u0060HTTP_\u0060 can be arbitrarily set by an attacker. Since there is a default entry in the \u0060poller\u0060 table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header \u0060Forwarded-For: \u0026lt;TARGETIP\u0026gt;\u0060. This way the function \u0060get_client_addr\u0060 returns the IP address of the server running Cacti. The following call to \u0060gethostbyaddr\u0060 will resolve this IP address to the hostname of the server, which will pass the \u0060poller\u0060 hostname check because of the default entry. After the authorization of the \u0060remote_agent.php\u0060 file is bypassed, an attacker can trigger different actions. One of these actions is called \u0060polldata\u0060. The called function \u0060poll_for_data\u0060 retrieves a few request parameters and loads the corresponding \u0060poller_item\u0060 entries from the database. If the \u0060action\u0060 of a \u0060poller_item\u0060 equals \u0060POLLER_ACTION_SCRIPT_PHP\u0060, the function \u0060proc_open\u0060 is used to execute a PHP script. The attacker-controlled parameter \u0060$poller_id\u0060 is retrieved via the function \u0060get_nfilter_request_var\u0060, which allows arbitrary strings. This variable is later inserted into the string passed to \u0060proc_open\u0060, which leads to a command injection vulnerability. By e.g. providing the \u0060poller_id=;id\u0060 the \u0060id\u0060 command is executed. In order to reach the vulnerable call, the attacker must provide a \u0060host_id\u0060 and \u0060local_data_id\u0060, where the \u0060action\u0060 of the corresponding \u0060poller_item\u0060 is set to \u0060POLLER_ACTION_SCRIPT_PHP\u0060. Both of these ids (\u0060host_id\u0060 and \u0060local_data_id\u0060) can easily be bruteforced. The only requirement is that a \u0060poller_item\u0060 with an \u0060POLLER_ACTION_SCRIPT_PHP\u0060 action exists. This is very likely on a productive instance because this action is added by some predefined templates like \u0060Device - Uptime\u0060 or \u0060Device - Polling Time\u0060. This command injection vulnerability allows an unauthenticated user to execute arbitrary commands if a \u0060poller_item\u0060 with the \u0060action\u0060 type \u0060POLLER_ACTION_SCRIPT_PHP\u0060 (\u00602\u0060) is configured. The authorization bypass should be prevented by not allowing an attacker to make \u0060get_client_addr\u0060 (file \u0060lib/functions.php\u0060) return an arbitrary IP address. This could be done by not honoring the \u0060HTTP_...\u0060 \u0060$_SERVER\u0060 variables. If these should be kept for compatibility reasons it should at least be prevented to fake the IP address of the server running Cacti. This vulnerability has been addressed in both the 1.2.x and 1.3.x release branches with \u00601.2.23\u0060 being the first release containing the patch.",
  "published": "2022-12-05T13:15:00Z",
  "severity": "High",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.99826,
  "epssPercentile": 0.9996,
  "priority": "Patch now",
  "priorityTier": 1,
  "exploited": true,
  "vendorExploited": false,
  "disclosed": false,
  "kev": {
    "added": "2023-02-16T00:00:00Z",
    "due": "2023-03-09T00:00:00Z",
    "ransomware": false,
    "requiredAction": "Apply updates per vendor instructions."
  },
  "fixes": [
    {
      "platform": "linux",
      "product": "cacti",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.2.22\u002Bds1-3",
      "fix": "DEBIAN-CVE-2022-46169",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-46169",
      "released": "2022-12-05T21:15:10Z"
    },
    {
      "platform": "linux",
      "product": "cacti",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.2.22\u002Bds1-3",
      "fix": "DEBIAN-CVE-2022-46169",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-46169",
      "released": "2022-12-05T21:15:10Z"
    },
    {
      "platform": "linux",
      "product": "cacti",
      "release": "Debian 14",
      "fixedVersion": "1.2.22\u002Bds1-3",
      "fix": "DEBIAN-CVE-2022-46169",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-46169",
      "released": "2022-12-05T21:15:10Z"
    },
    {
      "platform": "linux",
      "product": "cacti",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.1.38\u002Bds1-1ubuntu0.1~esm4",
      "fix": "cacti 1.1.38\u002Bds1-1ubuntu0.1~esm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-cacti-1.1.38-ds1-1ubuntu0.1-esm4",
      "released": "2022-12-05T13:15:00Z"
    },
    {
      "platform": "linux",
      "product": "cacti",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.2.10\u002Bds1-1ubuntu1.1\u002Besm2",
      "fix": "cacti 1.2.10\u002Bds1-1ubuntu1.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-cacti-1.2.10-ds1-1ubuntu1.1-esm2",
      "released": "2022-12-05T13:15:00Z"
    },
    {
      "platform": "linux",
      "product": "cacti",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.2.19\u002Bds1-2ubuntu1.1\u002Besm2",
      "fix": "cacti 1.2.19\u002Bds1-2ubuntu1.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-cacti-1.2.19-ds1-2ubuntu1.1-esm2",
      "released": "2022-12-05T13:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}