CVE-2025-66399

Executive Summary

CVE-2025-66399 is an input validation vulnerability in Cacti, an open-source performance and fault management framework. An authenticated attacker can inject control characters, including newlines, into SNMP community strings. These strings are stored verbatim in the database and later embedded into backend SNMP operations. In environments where downstream SNMP tooling interprets newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. The vulnerability is fixed in version 1.2.29.

Supply Chain & Package Security

Cacti is a PHP-based application distributed via GitHub and package repositories. The vulnerability is not in a package dependency but in the core application logic. Users should verify the integrity of their Cacti installation and ensure they are using the official source.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An authenticated Cacti user is needed.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The exploit does not affect other components.
• Confidentiality (C): High (H) - Potential for data exfiltration.
• Integrity (I): High (H) - Potential for data modification or command execution.
• Availability (A): High (H) - Potential for service disruption.

Threat Level: High. While authentication is required, the potential for command execution makes this a critical risk in environments where SNMP tooling is vulnerable to injection.

Deep Dive & Mechanics

The vulnerability resides in the SNMP device configuration functionality. When an authenticated user adds or edits a device, the SNMP community string is not sanitized for control characters. Specifically, newline characters (\n) are accepted and stored in the database.

Later, when Cacti performs SNMP operations (e.g., polling), it constructs shell commands or passes the community string to SNMP binaries (like snmpget or snmpwalk). If the downstream tooling interprets newlines as command separators, an attacker can inject arbitrary commands.

For example, a community string like public\nmalicious_command could cause the SNMP tool to execute malicious_command after the legitimate SNMP operation.

The fix in version 1.2.29 sanitizes the community string by stripping or escaping control characters before storage and use.

Vulnerable vs. Patched Code

Vulnerable Code (Cacti < 1.2.29):

// In snmp.php or similar
$community = $_POST['snmp_community'];
// No sanitization
$sql = "INSERT INTO devices (community) VALUES ('$community')";
db_execute($sql);

Patched Code (Cacti >= 1.2.29):

// In snmp.php or similar
$community = $_POST['snmp_community'];
// Sanitize control characters
$community = preg_replace('/[\x00-\x1F\x7F]/', '', $community);
$sql = "INSERT INTO devices (community) VALUES ('$community')";
db_execute($sql);

The patched version removes all control characters (ASCII 0-31 and 127) from the community string.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Cacti instance with an authenticated user account.
• The ability to add or edit a device.

Exploitation Steps:

1. Log in to Cacti.
2. Navigate to Console > Devices > Add.
3. In the SNMP Community field, enter a crafted string containing a newline and a command. For example:

   public\nid
   

4. Save the device.
5. Trigger an SNMP poll (e.g., by waiting for the poller or manually running it).
6. If the downstream SNMP tool interprets the newline, the command id will be executed.

Note: The exact behavior depends on the SNMP tooling in use. This is a chained attack requiring a vulnerable SNMP wrapper.

Blue Team

Detection:

• Monitor SNMP community strings for control characters.
• Audit Cacti database for suspicious community strings.
• Review SNMP poll logs for unexpected command execution.

Prevention:

• Upgrade to Cacti 1.2.29 immediately.
• Implement strict input validation on all SNMP fields.
• Use a Web Application Firewall (WAF) to block control characters in POST data.

Indicators of Compromise (IOCs)

• Network: SNMP community strings containing newline characters (\n, %0a, 0x0a).
• Host: Unexpected processes spawned by the Cacti poller (e.g., id, whoami, curl).
• Database: Rows in the devices table where the community field contains non-printable characters.
• Logs: Entries in Cacti logs showing unusual SNMP command output.

Detection Engineering

YARA Rule

rule CVE_2025_66399_SNMP_Injection {
    meta:
        description = "Detects Cacti SNMP community strings with control characters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66399"
    strings:
        $control_char = /[\x00-\x1F\x7F]/
    condition:
        $control_char
}

Sigma Rule

title: Cacti SNMP Community String Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to inject control characters into SNMP community strings in Cacti
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66399
logsource:
    category: application
    product: cacti
detection:
    selection:
        event: "SNMP community string"
        community|contains|all:
            - '\n'
            - '%0a'
    condition: selection
falsepositives:
    - Legitimate use of newlines in community strings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66399 Cacti SNMP Community String Injection"; flow:to_server,established; content:"POST"; http_method; content:"snmp_community"; http_client_body; pcre:"/[\x00-\x1F\x7F]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Cacti to version 1.2.29 or later.
• If upgrade is not possible, apply a virtual patch by sanitizing SNMP community strings in a reverse proxy or WAF.

Long-term:

• Implement input validation for all user-supplied data.
• Use parameterized queries or prepared statements for database operations.
• Regularly audit Cacti logs for suspicious activity.
• Restrict access to Cacti to trusted users only.

Workaround:

• Disable SNMP polling if not required.
• Use a dedicated SNMP proxy that sanitizes community strings.

Valters IT
Securing Digital Frontiers