CVE-2026-40080

Executive Summary

CVE-2026-40080 is an Open Redirect vulnerability in Cacti, an open-source performance and fault management framework. Versions 1.2.30 and prior are affected. The vulnerability arises from an insecure substring check (str_contains($referer, CACTI_PATH_URL)) used to validate the HTTP_REFERER header during login redirection. When a user has login_opts == '1' (redirect to referer after login), an attacker can craft a malicious referer URL (e.g., https://evil.com/cacti/) that contains the legitimate Cacti path (/cacti/). The substring match passes, and the user is redirected to the attacker-controlled domain after authentication. The pre-existing validate_redirect_url() function in lib/html_utility.php performs proper host validation but was not invoked from auth_login_redirect(). The fix in version 1.2.31 ensures this function is called.

Supply Chain & Package Security

This vulnerability is in the Cacti PHP application, which is typically distributed as a tarball or via package managers like apt or yum. There is no NPM, PyPI, Go, or Ruby component involved. However, administrators should verify the integrity of their Cacti installation by checking checksums or signatures provided by the official Cacti website.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The user must click a link or be redirected to a malicious site.
• Scope: Changed (S:C) - The redirect can lead to a different security domain (attacker-controlled site).
• Confidentiality Impact: Low (C:L) - Potential for information disclosure via phishing.
• Integrity Impact: Low (I:L) - The redirect can be used for phishing or malware distribution.
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is 6.1, the vulnerability is trivial to exploit and can be used in phishing campaigns to steal credentials or deliver malware. The EPSS score of 0.0% indicates low exploitation likelihood currently, but this may change as PoC code circulates.

Deep Dive & Mechanics

The vulnerability is in the auth_login_redirect() function, which handles post-authentication redirection. When login_opts == '1', the function uses $_SERVER['HTTP_REFERER'] directly to redirect the user. The validation logic uses str_contains($referer, CACTI_PATH_URL) to check if the referer contains the Cacti path (e.g., /cacti/). This is a substring check, not a host check.

Attack Scenario:

1. An attacker crafts a URL like https://evil.com/cacti/ and tricks a user into clicking it.
2. The user's browser sends a request to evil.com, which then redirects to the legitimate Cacti login page (e.g., https://cacti.example.com/cacti/).
3. The user logs in to Cacti.
4. After successful authentication, auth_login_redirect() checks the HTTP_REFERER header. The referer is https://evil.com/cacti/, which contains /cacti/, so the substring check passes.
5. The user is redirected to https://evil.com/cacti/, which is controlled by the attacker.

The pre-existing validate_redirect_url() function in lib/html_utility.php performs proper validation by parsing the URL and checking the host against a whitelist. However, it was not called from auth_login_redirect().

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.30 and prior):

// In auth_login_redirect()
if ($_SESSION['login_opts'] == '1') {
    $referer = $_SERVER['HTTP_REFERER'];
    if (str_contains($referer, CACTI_PATH_URL)) {
        header('Location: ' . $referer);
        exit;
    }
}

Patched Code (version 1.2.31):

// In auth_login_redirect()
if ($_SESSION['login_opts'] == '1') {
    $referer = $_SERVER['HTTP_REFERER'];
    if (validate_redirect_url($referer)) {
        header('Location: ' . $referer);
        exit;
    }
}

The validate_redirect_url() function properly parses the URL and checks that the host matches the expected Cacti host, preventing open redirects.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Cacti instance (version 1.2.30 or prior) with login_opts set to 1 (redirect to referer after login).
• An attacker-controlled domain (e.g., evil.com).

Exploitation Steps:

1. Set up a web server on evil.com that serves a page at /cacti/ (e.g., a phishing page).
2. Craft a URL: https://evil.com/cacti/ and trick a user into clicking it.
3. The user's browser will be redirected to the legitimate Cacti login page (e.g., https://cacti.example.com/cacti/).
4. The user logs in.
5. After login, the user is redirected to https://evil.com/cacti/, where the attacker can serve a fake login page or malware.

Example Exploit URL:

https://evil.com/cacti/

Blue Team

Detection:

• Monitor for unusual HTTP_REFERER headers in login requests. Legitimate referers should only contain the Cacti host.
• Look for login attempts followed by redirects to external domains.
• Check web server logs for HTTP_REFERER values that contain the Cacti path but are from different hosts.

Mitigation:

• Upgrade to Cacti version 1.2.31 or later.
• If upgrading is not immediately possible, set login_opts to 0 (redirect to default page) or 2 (redirect to specific URL) to disable referer-based redirection.
• Implement a Web Application Firewall (WAF) rule to block redirects to external domains after login.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Referer header containing a different host but including /cacti/ (e.g., Referer: https://evil.com/cacti/).
  • HTTP responses with Location header pointing to an external domain after a login request.
• Log IOCs:
  • Web server logs showing HTTP_REFERER values that do not match the legitimate Cacti host.
  • Authentication logs showing successful logins followed by redirects to external URLs.
• File IOCs:
  • Modified auth_login_redirect() function in lib/auth.php (if attacker has code execution).

Detection Engineering

YARA Rule

rule CVE_2026_40080_Open_Redirect {
    meta:
        description = "Detects vulnerable Cacti code with substring-based referer check"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-40080"
    strings:
        $vuln_func = "str_contains($referer, CACTI_PATH_URL)" nocase
        $vuln_cond = "login_opts == '1'" nocase
        $vuln_redirect = "header('Location: ' . $referer)" nocase
    condition:
        all of them
}

Sigma Rule

title: Cacti Open Redirect via HTTP_REFERER
id: 8f4b3c2a-1d5e-4f7b-9a0c-3e6d8f2b1a4c
status: experimental
description: Detects HTTP requests with suspicious Referer headers targeting Cacti login
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/cacti/index.php'
        cs-referer: 'https://*evil*'
    condition: selection
falsepositives:
    - Legitimate cross-site redirects from trusted partners
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-40080 Cacti Open Redirect via HTTP_REFERER"; flow:to_server,established; content:"Referer|3a|"; http_header; content:"/cacti/"; http_header; pcre:"/Referer:\s*https?:\/\/(?!cacti)[^\s]+\/cacti\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cacti: Update to version 1.2.31 or later. This is the only complete fix.
2. Disable Referer Redirect: If upgrading is not possible, set login_opts to 0 or 2 in the Cacti configuration to disable referer-based redirection.
3. WAF Rule: Implement a WAF rule to block redirects to external domains after login.

Long-Term Actions:

• Regularly update Cacti to the latest version.
• Conduct security audits of custom code or plugins.
• Monitor for new CVEs and apply patches promptly.

Workaround:

• Modify lib/auth.php to call validate_redirect_url() before redirecting. This is a temporary fix until upgrade.

Valters IT
Securing Digital Frontiers