CVE-2020-7237

An authenticated attacker with access to modify Performance Settings navigates to Console → Configuration → Settings → Performance and enters shell metacharacters in the Boost Debug Log field, e.g. `--verbose; cat /etc/passwd > rce.txt` [ref_id=1]. The value is saved even when `$input_whitelisting` is enabled. When a new poller cycle begins, `poller_automation.php` constructs a command such as `/bin/php

The vulnerability is in `poller_automation.php`, which accepts command-line arguments such as `--debug`, `--force`, `--verbose`, `--version`, or `--help` from the Performance Boost Debug Log field. The field is saved without input validation, and the value is passed directly into a shell command executed by the poller process [ref_id=1].

No patch is included in the bundle. The remediation guidance recommends applying input validation on the Boost Debug Log field (e.g., checking input length and allowed characters) or replacing the free-text field with a drop-down menu that only permits the intended arguments (`--debug`, `--force`, `--verbose`, `--version`, `--help`) [ref_id=1].

Navigate to Console → Configuration → Settings → Performance. In the Boost Debug Log field, enter `--verbose; cat /etc/passwd > rce.txt` and save. Wait for a new poller cycle to begin, then access `http://cacti/rce.txt` to view the contents of `/etc/passwd` [ref_id=1].