CVE-2025-45160

Executive Summary

CVE-2025-45160 is an HTML injection vulnerability in Cacti versions up to and including 1.2.29. The flaw resides in the file upload functionality, where an attacker can upload a file with an invalid format and inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the error popup response. This occurs because the submitted filename is reflected back without proper sanitization. The CVSS score is 0.0 due to disputed reproducibility, but the vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). No public exploit code or Nuclei template is available, and the patch status remains unconfirmed. The EPSS score is 0.0%, indicating low exploitation likelihood, but the risk is elevated for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Cacti PHP application directly.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 0.0 (Disputed)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Low (due to disputed nature and low EPSS)

Deep Dive & Mechanics

The vulnerability is triggered during file upload when an invalid file format is submitted. The application constructs an error popup that includes the filename without proper HTML encoding. An attacker can craft a filename containing HTML tags, which are then rendered in the victim's browser. For example, a filename like <h1>Injected</h1> would display as a heading in the error popup. This is a classic reflected HTML injection, which can be used for phishing, defacement, or session theft if combined with other vectors.

The issue is disputed by multiple third parties and the maintainer, who state it cannot be reproduced after version 1.2.27. However, the CVE description explicitly mentions versions up to 1.2.29. The root cause is the lack of htmlspecialchars() or similar encoding on the filename before output.

Vulnerable vs. Patched Code

Vulnerable Code (Cacti <= 1.2.29):

// In file upload handler
$filename = $_FILES['file']['name'];
// Directly used in error message
echo "<script>alert('Error: $filename');</script>";

Patched Code (Hypothetical):

$filename = htmlspecialchars($_FILES['file']['name'], ENT_QUOTES, 'UTF-8');
echo "<script>alert('Error: $filename');</script>";

No official patch is available; the above is a recommended fix.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Cacti 1.2.29 in a lab environment (e.g., Docker).
2. Craft Payload: Create a file with a malicious filename, e.g., <svg onload=alert(1)>.
3. Upload: Use a tool like curl or a browser to upload the file to the vulnerable endpoint.

   curl -F "file=@/dev/null;filename=<svg onload=alert(1)>" http://target/cacti/upload.php
   

4. Trigger: The error popup will execute the injected HTML/JavaScript.

Blue Team

1. Monitor: Look for file upload requests with suspicious filenames containing HTML tags.
2. Log Analysis: Check web server logs for patterns like <, >, onload, onerror.
3. WAF Rules: Block filenames containing < or > characters.
4. User Training: Educate users to avoid clicking on error popups from untrusted sources.

Indicators of Compromise (IOCs)

• Network: HTTP requests with filenames containing HTML tags (e.g., <h1>, <svg onload=...>).
• Logs: Web server access logs showing POST requests to upload endpoints with encoded HTML in the filename parameter.
• File System: Uploaded files with names like <script>alert(1)</script>.txt in temporary directories.
• Behavior: Unexpected popups or page modifications after file upload attempts.

Detection Engineering

YARA Rule

rule CVE_2025_45160_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in file upload filenames"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45160"
    strings:
        $html_tag = /<[a-zA-Z\/!][^>]*>/
        $upload_path = /upload\.php/
    condition:
        $upload_path and #html_tag > 0
}

Sigma Rule

title: CVE-2025-45160 HTML Injection via File Upload
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects file upload requests with HTML tags in the filename
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'upload.php'
        cs-uri-query|re: '<[a-zA-Z\/!][^>]*>'
    condition: selection
falsepositives:
    - Legitimate filenames with angle brackets (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45160 HTML Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"upload.php"; http_uri; pcre:"/<[a-zA-Z\/!][^>]*>/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Cacti version 1.2.30 or later if available. If not, apply input sanitization to filenames using htmlspecialchars().
2. Workaround: Implement a web application firewall (WAF) rule to block filenames containing < or >.
3. Monitoring: Enable detailed logging for file upload endpoints and review for suspicious patterns.
4. User Awareness: Train users to avoid interacting with error popups from untrusted sources.
5. Vendor Contact: Monitor Cacti's official channels for patch announcements.

Valters IT
Securing Digital Frontiers