security: escape the WMI hostname and namespace before exec - #13
Open
somethingwithproof wants to merge 4 commits into
Open
security: escape the WMI hostname and namespace before exec#13somethingwithproof wants to merge 4 commits into
somethingwithproof wants to merge 4 commits into
Conversation
Automated fixes: - XSS: escape request variables in HTML value attributes - SQLi: convert string-concat queries to prepared statements - Deserialization: add allowed_classes=>false - Temp files: replace rand() with tempnam() Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
- Change Dependabot ecosystem from npm to composer (PHP-only repo) - Remove PHP from CodeQL paths-ignore so security PRs get analysis - Remove committed .omc session artifacts, add .omc/ to .gitignore Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Linux_WMI::clean() escaped the username, password, binary and command but left
the device hostname only trimmed and the query namespace untouched, so
getcommand() interpolated them raw into the wmic command line that exec() runs
on the Cacti server. A device-supplied hostname such as
127.0.0.1; touch /tmp/pwned #
therefore ran a command on the poller.
Escape the hostname and namespace with cacti_escapeshellarg, and on Windows
strip the cmd.exe metacharacters (" & | ^ < > ( ) %) that cmd.exe interprets
despite quoting. A standalone regression test in tests/ verifies both.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
The default separator (|+|) contains pipe characters, so the unquoted --delimiter=|+| made exec() split the command into a shell pipeline (exit 127, no data). Quote it in getcommand() while keeping the property raw for the explode() in fetch(). issue#5 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
This was referenced Aug 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linux_WMI::clean()escaped the username, password, binary and command withcacti_escapeshellarg, but left the device hostname onlytrim()'d and the query namespace untouched.getcommand()then interpolated both raw into thewmiccommand line thatexec()runs on the Cacti server.A device configured with a hostname such as
therefore executes a command on the poller when its WMI data query runs — a device-manager to server-RCE.
Fix
cacti_escapeshellarginclean(), like the other fields" & | ^ < > ( ) %) that cmd.exe interprets despite quoting (it ignores\", toggles quoting on every", and expands%VAR%); a hostname/namespace never legitimately contains thesetrim()ingetcommand()Test
tests/WmiCommandInjectionTest.php(standalone — the plugin has no harness) confirms an injected hostname is quote-contained on unix and metachar-stripped on Windows.php tests/WmiCommandInjectionTest.phpexits 0.Also in this PR
unserialize()on the stored credential blob now passesallowed_classes => false.|+|was interpolated into--delimiter=unquoted, soexec()split the command into a shell pipeline (exit 127, no data). Now quoted for the shell while the property stays raw for theexplode()infetch().Closes #5 (restrict unserialize and audit exec command paths).
Closes #19