Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API

An attacker can exploit this vulnerability by uploading a specially crafted XML template file. If the file fails validation, the server will display a JavaScript pop-up containing the unfiltered filename, which can include malicious JavaScript code. This can be achieved by accessing the `templates_import.php` page and uploading a file named `');alert(1);var xx = '.xml` or `');alert(1);('`. [ref_id=1, ref_id=2]

The vulnerability resides in the `raise_message_javascript` function located in `lib/functions.php`. This function is responsible for displaying JavaScript messages, and it directly embeds the `$title` and `$header` variables into script tags without proper sanitization. The issue arises when these variables, which can contain user-supplied data like filenames, are not escaped, allowing for script injection. [ref_id=1, ref_id=2]

The fix involves properly sanitizing the `$title` and `$header` variables before they are embedded within the JavaScript code. This is achieved by using `json_encode` to ensure that any special characters, including single quotes, are correctly escaped, preventing them from breaking out of the JavaScript string literals. This prevents the injection of arbitrary JavaScript code. [ref_id=2]

1. Log in to Cacti. 2. Navigate to `http://ip/cacti/templates_import.php`. 3. Prepare an XML file with a malicious name, such as `');alert(1);var xx = '.xml` or `');alert(1);('`.xml. 4. Upload this file.