CVE-2017-12065 (published 2017-08-01T05:29Z)

spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Cacti/cacti
commit_details: repo_url: https://github.com/Cacti/cacti
author: cigamit
author_date: 2017-07-26 07:01:27-05:00
msg: Resolving Issue #877

Improving resolution to #847 and one additional vulnerability.
repository: repo_url: https://github.com/Cacti/cacti
repo_name: Cacti/cacti
description: Cacti ™
repo_language: PHP
owner: Cacti
file_changes: filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,7 @@ Cacti CHANGELOG
 
 1.1.16
 -issue#875: When modifying Realm permissions, realms that are listed multiple times don't stay in sync
+-issue#877: Improving resolution to issue#847 and one additional vulnerability
 -issue: Address additional corner cases around get_order_string usage
 
 1.1.15

programming_language: Markdown
filename: html_form.php
change_type: ModificationType.MODIFY
diff: @@ -1113,8 +1113,8 @@ function form_confirm_buttons($action_url, $cancel_url) {
 	?>
 	<tr>
 		<td align='right'>
-			<input type='button' onClick='cactiReturnTo("<?php print htmlspecialchars($config['url_path'] . $cancel_url);?>")' value='<?php print __esc('Cancel');?>'>
-			<input type='button' onClick='cactiReturnTo("<?php print htmlspecialchars($config['url_path'] . $action_url . '&confirm=true');?>")' value='<?php print __esc('Delete');?>'>
+			<input type='button' onClick='cactiReturnTo("<?php print htmlspecialchars($config['url_path'] . $cancel_url, ENT_QUOTES);?>")' value='<?php print __esc('Cancel');?>'>
+			<input type='button' onClick='cactiReturnTo("<?php print htmlspecialchars($config['url_path'] . $action_url . '&confirm=true', ENT_QUOTES);?>")' value='<?php print __esc('Delete');?>'>
 		</td>
 	</tr>
 <?php }
@@ -1150,7 +1150,7 @@ function form_save_button($cancel_url, $force_type = '', $key_field = 'id', $aja
 	}
 
 	if ($force_type != 'import' && $force_type != 'export' && $force_type != 'save' && $cancel_url != '') {
-		$cancel_action = "<input type='button' onClick='cactiReturnTo(\"" . htmlspecialchars($cancel_url) . "\")' value='" . $calt . "'>";
+		$cancel_action = "<input type='button' onClick='cactiReturnTo(\"" . htmlspecialchars($cancel_url, ENT_QUOTES) . "\")' value='" . $calt . "'>";
 	} else {
 		$cancel_action = '';
 	}

programming_language: PHP
filename: spikekill.php
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@ if (isset_request_var('method')) {
 if (is_realm_allowed(1043)) {
 	$local_data_ids = db_fetch_assoc_prepared('SELECT DISTINCT data_template_rrd.local_data_id
 		FROM graph_templates_item
-		LEFT JOIN data_template_rrd 
+		LEFT JOIN data_template_rrd
 		ON graph_templates_item.task_item_id=data_template_rrd.id
 		WHERE graph_templates_item.local_graph_id = ?', array(get_filter_request_var('local_graph_id')));
 
@@ -57,20 +57,20 @@ if (is_realm_allowed(1043)) {
 					cacti_log(read_config_option('path_php_binary') . ' -q ' . $config['base_path'] . '/cli/removespikes.php ' .
 						' -R=' . $data_source_path . (isset_request_var('dryrun') ? ' --dryrun' : '') .
 						(isset_request_var('method') ? ' -M=' . get_nfilter_request_var('method'):'') .
-						(isset_request_var('avgnan') ? ' -A=' . get_nfilter_request_var('avgnan'):'') .
-						(isset_request_var('outlier-start') ? ' --outlier-start=' . get_nfilter_request_var('outlier-start'):'') .
-						(isset_request_var('outlier-end') ? ' --outlier-end=' . get_nfilter_request_var('outlier-end'):'') .
-						' -U=' . $_SESSION['sess_user_id'] . 
+						(isset_request_var('avgnan') ? ' -A=' . escapeshellarg(get_nfilter_request_var('avgnan')):'') .
+						(isset_request_var('outlier-start') ? ' --outlier-start=' . escapeshellarg(get_nfilter_request_var('outlier-start')):'') .
+						(isset_request_var('outlier-end') ? ' --outlier-end=' . escapeshellarg(get_nfilter_request_var('outlier-end')):'') .
+						' -U=' . $_SESSION['sess_user_id'] .
 						' --html', false);
 				}
 
 				$results .= shell_exec(read_config_option('path_php_binary') . ' -q ' . $config['base_path'] . '/cli/removespikes.php ' .
 					' -R=' . $data_source_path . (isset_request_var('dryrun') ? ' --dryrun' : '') .
 					(isset_request_var('method') ? ' -M=' . get_nfilter_request_var('method'):'') .
-					(isset_request_var('avgnan') ? ' -A=' . get_nfilter_request_var('avgnan'):'') .
-					(isset_request_var('outlier-start') ? ' --outlier-start=' . get_nfilter_request_var('outlier-start'):'') .
-					(isset_request_var('outlier-end') ? ' --outlier-end=' . get_nfilter_request_var('outlier-end'):'') .
-					' -U=' . $_SESSION['sess_user_id'] . 
+					(isset_request_var('avgnan') ? ' -A=' . escapeshellarg(get_nfilter_request_var('avgnan')):'') .
+					(isset_request_var('outlier-start') ? ' --outlier-start=' . escapeshellarg(get_nfilter_request_var('outlier-start')):'') .
+					(isset_request_var('outlier-end') ? ' --outlier-end=' . escapeshellarg(get_nfilter_request_var('outlier-end')):'') .
+					' -U=' . $_SESSION['sess_user_id'] .
 					' --html');
 			}
 		}

programming_language: PHP