Summary

An admin can change Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI.

Details

An admin can change the Poller Standard Error Log Path in installation step 5 (no need to complete the steps before or after step 5) to a local file such as /etc/passwd and view the content of /etc/passwd file under the Logs tab as seen in the screenshots below.

Ad admin user (or users with the privilege to change Poller Standard Error Log Path under Configuration->Settings->Paths tab ) can achieve the same result from Configuration->Settings->Paths tab as seen in the screenshots below. Here, /var/www/html/cacti/include/config.php file is chosen as example.

PoC

• Change the Poller Standard Error Log Path from either installation step 5 or from Configuration->Settings->Paths tab to /etc/passwd.
• Go to Logs tab and select the passwd file.

Impact

It allows users with the privilege to change Poller Standard Error Log Path to view sensitive files on the server.