Unauthenticated Command Injection (CVE-2022-46169)

What is affected, what to do

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device.

The vulnerability is being actively exploited; treat it as a priority. Update Cacti to version 1.2.23. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Cacti lt *..1.2.23

Fixed in

• Cacti 1.2.23

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade Cacti to 1.2.23 or later (upstream patch fixes both the get_client_addr authentication bypass and the poll_for_data command injection). The 1.3.x branch has an equivalent fix commit.
   • If patching has to wait, block remote_agent.php at the web server (Apache: <Files remote_agent.php> Require all denied </Files>, Nginx: location = /remote_agent.php { deny all; }) or drop it at the reverse proxy/WAF.
   • Pull the Cacti web UI off the internet: restrict TCP/80 and TCP/443 on the Cacti host to the management VLAN or VPN only. Run a Shodan/Censys sweep across your own ASN/IP ranges with title:"Cacti" to find forgotten instances.
   • Hunt for compromise on every reachable instance: inspect the web root and /tmp for unexpected PHP files, cron entries owned by www-data/apache, and unusual outbound connections from the web server process. Isolate and preserve any host that looks tampered with.
   • Rotate Cacti admin credentials and the Cacti DB user. Treat API tokens and any credentials stored inside Cacti (SNMP communities, SSH keys used by pollers) as potentially stolen.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: move the Cacti server into a dedicated management VLAN; ingress only from SOC/NOC jump hosts. Restrict egress to the monitored estate and update mirrors so a reverse shell has nowhere to call home.
   • WAF / reverse proxy: drop every request to /remote_agent.php or source-IP allowlist it. Strip or validate the headers Forwarded, X-Forwarded-For, Forwarded-For, X-Real-IP, Client-IP at the perimeter — the auth bypass depends exactly on those headers being attacker-controlled.
   • Web server hardening: configure PHP with disable_functions=proc_open,exec,shell_exec,system,passthru,popen if your Cacti setup tolerates it (some features will break — test first). As a minimum, set open_basedir to the Cacti directory.
   • Database hardening: review the default poller table entry and set the hostname to something that is not trivially reachable via reverse DNS of the server's own IP (temporary mitigation, not a substitute for the patch).
   • Least privilege: run the Cacti PHP process as its own unprivileged user, no sudo, no write access outside /var/lib/cacti and /var/log/cacti. Enforce an SELinux or AppArmor profile.
   • Reduce monitoring blast radius: review stored SSH keys and SNMPv3 credentials that target wide swathes of devices and downgrade their scope to read-only where possible.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: any request to remote_agent.php from outside the admin network is suspicious. SPL example: index=web uri_path="/remote_agent.php" NOT src_ip IN (<admin_cidr>) | stats count by src_ip, uri_query. Alert hard when action=polldata carries a poller_id containing shell metacharacters (;, |, `, $().
   • Request-header anomalies: inbound HTTP headers Forwarded-For, X-Forwarded-For or Forwarded whose value matches the Cacti host's own IP are the fingerprint of the auth bypass. Zeek/Suricata rule on http.request_headers.
   • Sysmon / auditd process ancestry: apache2/httpd/php-fpm spawning sh/bash and then id/uname/curl/wget/nc/python is abnormal for a monitoring app. Sigma shape: parent_image endswith /php-fpm OR /httpd AND image endswith /sh OR /bash.
   • EDR / network: outbound connections from the web server account to non-allowlisted IPs, especially ports 4444, 1337, 8080 or DNS-TXT tunnelling patterns. KQL: DeviceNetworkEvents | where InitiatingProcessAccountName in ("www-data","apache") | where RemoteIPType == "Public".
   • File-integrity monitoring: new or modified .php files under /usr/share/cacti, /var/www/html/cacti, /tmp outside the patch window. auditd rule: -w /usr/share/cacti/ -p wa -k cacti_webroot.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVER` variables to determine the IP address of the client. The variables beginning with `HTTP_` can be arbitrarily set by an attacker. Since there is a default entry in the `poller` table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header `Forwarded-For: <TARGETIP>`. This way the function `get_client_addr` returns the IP address of the server running Cacti. The following call to `gethostbyaddr` will resolve this IP address to the hostname of the server, which will pass the `poller` hostname check because of the default entry. After the authorization of the `remote_agent.php` file is bypassed, an attacker can trigger different actions. One of these actions is called `polldata`. The called function `poll_for_data` retrieves a few request parameters and loads the corresponding `poller_item` entries from the database. If the `action` of a `poller_item` equals `POLLER_ACTION_SCRIPT_PHP`, the function `proc_open` is used to execute a PHP script. The attacker-controlled parameter `$poller_id` is retrieved via the function `get_nfilter_request_var`, which allows arbitrary strings. This variable is later inserted into the string passed to `proc_open`, which leads to a command injection vulnerability. By e.g. providing the `poller_id=;id` the `id` command is executed. In order to reach the vulnerable call, the attacker must provide a `host_id` and `local_data_id`, where the `action` of the corresponding `poller_item` is set to `POLLER_ACTION_SCRIPT_PHP`. Both of these ids (`host_id` and `local_data_id`) can easily be bruteforced. The only requirement is that a `poller_item` with an `POLLER_ACTION_SCRIPT_PHP` action exists. This is very likely on a productive instance because this action is added by some predefined templates like `Device - Uptime` or `Device - Polling Time`. This command injection vulnerability allows an unauthenticated user to execute arbitrary commands if a `poller_item` with the `action` type `POLLER_ACTION_SCRIPT_PHP` (`2`) is configured. The authorization bypass should be prevented by not allowing an attacker to make `get_client_addr` (file `lib/functions.php`) return an arbitrary IP address. This could be done by not honoring the `HTTP_...` `$_SERVER` variables. If these should be kept for compatibility reasons it should at least be prevented to fake the IP address of the server running Cacti. This vulnerability has been addressed in both the 1.2.x and 1.3.x release branches with `1.2.23` being the first release containing the patch.

Source: CSA/SingCERT, Debian Security Advisories, pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Cacti Cacti
• Debian Cacti

Weakness classes (CWE)

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  Class

  The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

  Entry at MITRE CWE-74

References & sources

• github.comCacti/cacti/security/advisories/GHSA-6p93-p743-35gfx_refsource_CONFIRM, Exploit, Mitigation, Patch, Third-party advisory, pwn-watch
• github.comCacti/cacti/commit/7f0e16312dd5ce20f93744ef8b9c3b0f1ece2216x_refsource_MISC, Patch, Third-party advisory
• github.comCacti/cacti/commit/a8d59e8fa5f0054aa9c6981b1cbe30ef0e2a0ec9x_refsource_MISC, Patch, Third-party advisory
• github.comCacti/cacti/commit/b43f13ae7f1e6bfe4e8e56a80a7cd867cf2db52bx_refsource_MISC, Patch, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-46169government-resource, US government resource
• pwn.watchpwn.watch: Cacti: Command Injection (CVE-2022-46169)pwn-watch
• NVD (NIST)NVD: CVE-2022-46169pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch