Bypass de Autenticação ao usar hashes de senha mais antigos

The core of this vulnerability lies in Cacti's password handling process. Specifically, the compatpasswordhash and compatpasswordverify functions are used inconsistently, falling back to MD5 hashing when more secure methods like password_verify are unavailable (due to PHP versions < 5.5.0). This means an attacker can craft a password that, when hashed using MD5, matches a legitimate user's MD5-hashed password stored in the database, effectively bypassing authentication. Successful exploitation grants an attacker full access to the Cacti interface, enabling them to modify configurations, view sensitive network data, and potentially pivot to other systems within the network. The impact is particularly severe given Cacti's role in network monitoring, where compromised credentials could lead to widespread disruption and data breaches.

Organizations heavily reliant on Cacti for network monitoring are particularly at risk. This includes managed service providers (MSPs) hosting Cacti instances for multiple clients, as a single compromised instance could impact numerous customers. Systems with legacy PHP installations (< 5.5.0) are also at heightened risk, as they are more likely to be vulnerable to this bypass.

• linux / server:

journalctl -u cacti | grep -i password

• generic web:

curl -I http://your-cacti-server/ | grep Server

(Check for Cacti version string to identify vulnerable instances) • php:

php -m | grep password

(Verify PHP version is >= 5.5.0)

1. 2024-05-13Disclosure

   disclosure

1. Reservado2024-05-02
2. Publicada2024-05-13
3. Modificada2025-11-04
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-34340 is to immediately upgrade Cacti to version 1.2.27 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. While no perfect workaround exists, restricting access to the password change functionality and closely monitoring login attempts for suspicious activity can help reduce the risk. Ensure PHP version 5.5.0 or higher is used to leverage the more secure password hashing functions. After upgrading, confirm the fix by attempting to authenticate with a known, strong password and verifying that the password change functionality behaves as expected.