- ensure that mime type will be updated.
- stop that rrd_function_process_graph_options will be forced to export PNG format only if Realtime has been identified as requestor.
This is a low risk exploit as the default Cacti configuration is set such that the Guest account is disabled, the Guest account has no access to realtime graphs under permissions and the guest template user is not set.
It should also be noted, that this issue only seems to affect PHP versions before 7.2 and as such that again mitigates the likelihood of this being exploited.
However, should someone running PHP 7.1 or before, enable access to realtime graphs for guest users (which is against the recommendations of the group), it would be possible to craft a malicious packet that could be executed unwittingly.
The main reason for this is a lack of escaping around the session_id() when assigned to the poller id whilst building on the command to run poller_realtime.php. The simple fix was to hash the value so that it generated a reasonable unique poller id, that couldn't execute code.
This fix has already been verified by @mhasker before posting his findings.
Closes#3285
* Fixed: #2964 to add missed argv for all rrd_function_graph caller
* Fixed#2964: Apply security solution to aggregate graph preview and graph impage page
* Realtime log non ordinary message
* This is new in develop. Therefore, no CHANGELOG
* Also, don't log to standard output when updating single data source in boost. It breaks REALTIME.
* Moving all argument composition for backgrounded calls of php to 'assemble_php_args()' in /lib/functions.php.
* lib/functions.php: Explicitely prepending all assembled arguments.
* lib/functions.php: Removing an accidental appending of the initial args in assemble_php_args().
* Introducing the prepending of the current php.ini file, if any, to the extra arguments of backgrounded php calls (used with exec_background).
This enables the backgrounded process to stay in the same environment as the main one and not default back to a system wide default configuration file (which might or might not have configurations setup properly).
* Prepending the current php.ini in use (if any) to any exec() or shell_exec() call, that is doing a backgrounded call of the php executable.
* graph_realtime.php: Fixing missing whitespace between executable and first argument.
Resolving this and a few other minor memory leaks. Everything should
and have been validated to be working properly now. There were a few
additional issues I found in performing a full regression.
Jing Chen