Skip to content

security: fix SSRF, command injection, and XSS in core functions (1.2.x) #6913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 5 commits into from
Mar 29, 2026
Merged

security: fix SSRF, command injection, and XSS in core functions (1.2.x) #6913

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
32b6e84
security: fix SSRF, command injection, and XSS in core functions (1.2.x)
somethingwithproof Mar 29, 2026
2a4c8c7
Update lib/database.php
TheWitness Mar 29, 2026
0be2025
Refactor db_dump_data function for clarity
TheWitness Mar 29, 2026
c47e035
Enhance URL validation to prevent SSRF
TheWitness Mar 29, 2026
7827136
Merge branch '1.2.x' into backport/1.2.x-audit-findings
TheWitness Mar 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions lib/database.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2192,11 +2192,13 @@ function db_switch_main_to_local() {
*/
function db_dump_data($database = '', $tables = '', $credentials = array(), $output_file = false, $options = '--extended-insert=FALSE') {
global $database_default, $database_username, $database_password;

$credentials_string = '';

if ($database == '') {
$database = $database_default;
}

if (cacti_sizeof($credentials)) {
foreach ($credentials as $key => $value) {
$name = trim($key);
Expand Down Expand Up @@ -2227,22 +2229,35 @@ function db_dump_data($database = '', $tables = '', $credentials = array(), $out
}
}
}

if (!isset($password)) {
$password = $database_password;
}

if (!isset($username)) {
$username = $database_username;
}

if ($output_file === false) {
$output_file = '/tmp/cacti.dump.sql';
}

$safe_database = cacti_escapeshellarg($database);
$safe_output = cacti_escapeshellarg($output_file);

if (strstr($options, '--defaults-extra-file') !== false) {
exec("mysqldump $options $credentials_string $database $tables > " . $output_file, $output, $retval);
exec("mysqldump $options $credentials_string $safe_database $tables > " . $safe_output, $output, $retval);
} else {
exec("mysqldump $options $credentials_string " . $database . ' version >/dev/null 2>&1', $output, $retval);
exec("mysqldump $options $credentials_string " . $safe_database . ' version >/dev/null 2>&1', $output, $retval);

if ($retval) {
exec("mysqldump $options $credentials_string -u" . $username . ' -p' . $password . ' ' . $database . " $tables > " . $output_file, $output, $retval);
$pass_arg = ($password != '') ? ' -p' . cacti_escapeshellarg($password) : '';
exec("mysqldump $options $credentials_string -u" . cacti_escapeshellarg($username) . $pass_arg . ' ' . $safe_database . " $tables > " . $safe_output, $output, $retval);
} else {
exec("mysqldump $options $credentials_string $database $tables > " . $output_file, $output, $retval);
exec("mysqldump $options $credentials_string $safe_database $tables > " . $safe_output, $output, $retval);
}
}

return $retval;
}

6 changes: 6 additions & 0 deletions lib/functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6254,6 +6254,12 @@ function call_remote_data_collector($poller_id, $url, $logtype = 'WEBUI') {
}
}

// Validate URL is a relative path to prevent SSRF
if (strpos($url, '://') !== false || strpos($url, '@') !== false || strpos($url, '../') !== false || (strlen($url) > 0 && $url[0] !== '/')) {
cacti_log('ERROR: Invalid URL passed to call_remote_data_collector: ' . $url, false, 'SECURITY');
return '';
}

$fgc_contextoption = get_default_contextoption();
$fgc_context = stream_context_create($fgc_contextoption);

Expand Down