Cacti Local File Inclusion Vulnerability via Poller Standard Error Log Path

A local file inclusion vulnerability has been identified in Cacti versions prior to 1.2.29. An administrator can modify the 'Poller Standard Error Log Path' parameter to point to a local file on the server. Once the path is set, the file's contents can be viewed through the web UI by selecting the file name in the Logs tab. This issue allows sensitive files to be accessed via the application interface.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, depending on the file paths chosen.

Reproduction

To reproduce this vulnerability, an administrator must change the 'Poller Standard Error Log Path' to a local file, such as '/etc/passwd'. After setting the path, the Logs tab can be accessed to select the chosen file, which will then display its contents in the web UI.

Remediation

Users can update to Cacti version 1.2.29 or later to address this vulnerability.