Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723

From: Salvatore Bonaccorso <[email-masked]>
Date: Mon, 23 Sep 2019 22:20:27 +0200

Source: cacti
Version: 1.2.6+ds1-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/2964

Hi,

The following vulnerability was published for cacti, filling for
tracking the upstream issue. At time of writing, I think there was not
a patch upstream yet.

CVE-2019-16723[0]:
| In Cacti through 1.2.6, authenticated users may bypass authorization
| checks (for viewing a graph) via a direct graph_json.php request with
| a modified local_graph_id parameter.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-16723
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16723
[1] https://github.com/Cacti/cacti/issues/2964

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: Paul Gevers <[email-masked]>
Date: Mon, 23 Sep 2019 22:28:31 +0200

Hi Salvatore,

Thanks for your report.

> tracking the upstream issue. At time of writing, I think there was not

I think there is:
https://github.com/Cacti/cacti/commit/7a6a17252a1cbda180b61fff244cb3ce797d5264

It mentioned the wrong issue, as documented here:
https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c

Paul

---

From: Salvatore Bonaccorso <[email-masked]>
Date: Tue, 24 Sep 2019 05:58:19 +0200

Hi Paul,

> https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c

"Ack", thank you!

Regards,
Salvatore

---

From: Paul Gevers <[email-masked]>
Date: Tue, 24 Sep 2019 20:43:46 +0200

Hi,

>> https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c

While trying to figure out if old-stable is affected, I noticed this is
part of the fix:
https://github.com/Cacti/cacti/commit/c7cf4a26e4848872b48094e67f8d0a01dd7613d2

Paul

---

From: Salvatore Bonaccorso <[email-masked]>
Date: Tue, 24 Sep 2019 20:55:54 +0200

Hi,

> https://github.com/Cacti/cacti/commit/c7cf4a26e4848872b48094e67f8d0a01dd7613d2

Added this as well as further reference for the CVE!

Regards,
Salvatore

---

From: Paul Gevers <[email-masked]>
Date: Tue, 24 Sep 2019 21:02:58 +0200

Hi,

Although not 100% sure yet, I seriously doubt that old stable is
affected as version 1.0.0 has this:

-feature: New Graph Permissions system designed to make permissions
simple to manage

So I believe the affected code was only introduced then.

Paul

---

From: Salvatore Bonaccorso <[email-masked]>
Date: Sat, 28 Sep 2019 23:41:37 +0200

Hi Paul,

> So I believe the affected code was only introduced then.

I tried to get an idea here, but still I'm not sure 100%. Isn't for
instance the is_graph_allowed check missing in e.g. graph_xport.php,
so before accessing the graph_info, there is no check for if the user
is allowed to access the graph. For other parts this is done in
0.8.8h.

When in doupt, I rather would prefer to "wrongly" mark something as
affected rather than triage it as not-affected, and later to be turned
wrong.

Although the CVE assignment is somehow specific to the graph_json.php
part, which is not present in 0.8.8h I'm raising still the above, as
upstream has at least decided to cover the other changes for
permission checks in the two related commits.

Is upstream available to check and to confirm the stretch version is
not affected despite the potential missing permission checks there?

Regards,
Salvatore

---

From: Paul Gevers <[email-masked]>
Date: Sat, 28 Sep 2019 23:03:48 +0200

Hi Salvatore,

> not affected despite the potential missing permission checks there?

I already noted on IRC the other day that I think the pre 1 code is
affected as well. So I agree with your assessment.

Paul

---

From: Salvatore Bonaccorso <[email-masked]>
Date: Sun, 29 Sep 2019 08:45:40 +0200

Hi Paul,

> affected as well. So I agree with your assessment.

Ack, thanks for confirming (and regarding the note on IRC, I guess I
just missed it).

Regards,
Salvatore

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Mon, 07 Oct 2019 19:21:12 +0000

Your message dated Mon, 07 Oct 2019 19:19:23 +0000
with message-id <[email-masked]>
and subject line Bug#941036: fixed in cacti 1.2.7+ds1-1
has caused the Debian Bug report #941036,
regarding cacti: CVE-2019-16723
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
941036: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941036
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: CVE-2019-16723
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Mon, 23 Sep 2019 22:20:27 +0200

Source: cacti
Version: 1.2.6+ds1-2
Severity: important
Tags: security upstream

Hi,

CVE-2019-16723[0]:

Regards,
Salvatore

Subject: Bug#941036: fixed in cacti 1.2.7+ds1-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Mon, 07 Oct 2019 19:19:23 +0000

Source: cacti
Source-Version: 1.2.7+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sun, 06 Oct 2019 22:10:41 +0200
Source: cacti
Architecture: source
Version: 1.2.7+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 941036
Changes:
 cacti (1.2.7+ds1-1) unstable; urgency=medium
 .
   * New upstream version 1.2.7+ds1
     CVE-2019-16723 Security issue allows to view all graphs (Closes:
     #941036)
   * Refresh and drop patches to match upstream
Checksums-Sha1:
 c6bac5a74aa25fc5d3d0ba249f932cf5ff53d2df 2221 cacti_1.2.7+ds1-1.dsc
 23c79d84c107519d70c3c5ee5ac7d487b5bf059e 13510719 cacti_1.2.7+ds1.orig-docs-source.tar.gz
 755b2f1d1d96b373ffcfbb357d501eebe3a27234 7142490 cacti_1.2.7+ds1.orig.tar.gz
 9c000f345a9638d9bef6590a30629d4585838874 53332 cacti_1.2.7+ds1-1.debian.tar.xz
Checksums-Sha256:
 6f6f2feaba29dc2df9726820b60b911b979f2180dd7e0a090b7f321cd9c7871e 2221 cacti_1.2.7+ds1-1.dsc
 4fbd81cf0cd17dfcbb0c902dfa9abe00b369da9c66978c893f792eed7981d467 13510719 cacti_1.2.7+ds1.orig-docs-source.tar.gz
 8beb298290f07813c4ef8b8daa39c56b7fe893e72cbd18e106c74949c50cb4e0 7142490 cacti_1.2.7+ds1.orig.tar.gz
 29a161f3c0883e5a642c72a0bd94c4e972eda03624ca380743d1fc7adfe0b7f2 53332 cacti_1.2.7+ds1-1.debian.tar.xz
Files:
 19c09c42a2ceddc96e8dc7a6d80d4d95 2221 web optional cacti_1.2.7+ds1-1.dsc
 0cffaa89e42911b9bb5a8960cc3fb17b 13510719 web optional cacti_1.2.7+ds1.orig-docs-source.tar.gz
 ee74cf469f90ffaaae35c48c2a539951 7142490 web optional cacti_1.2.7+ds1.orig.tar.gz
 bda62558ac3ed76b39a3c448703365d2 53332 web optional cacti_1.2.7+ds1-1.debian.tar.xz

---

From: Hugo Lefeuvre <[email-masked]>
Date: Wed, 16 Oct 2019 14:23:47 +0200

Hi Salvatore, Paul,

I had a look at this issue in jessie, stretch and buster. I concluded that
jessie and stretch are not affected. I have reproduced the issue in buster.

# Quick breakdown:

Graphs are retrieved using rrdtool_function_graph() from lib/rrd.php, this
is true for jessie onwards.

rrdtool_function_graph() has a check for permissions, which is in fact very
similar to the ones introduced in 7a6a17252 and c7cf4a26e.

Before cf73ae1a9f65b5a27d7f9d10c8e14835c3a76326[0] this check in
rrdtool_function_graph() was always executed. After this commit the check
is only executed when $user > 0.

Note: 0 is the default value for $user:

    [lib/rrd.php:1179][1]

    function rrdtool_function_graph($local_graph_id, $rra_id, $graph_data_array,
        $rrdtool_pipe = '', &$xport_meta = array(), $user = 0) {
    ...

However graph_image.php, graph_json.php and rrdtool_function_xport() call
rrdtool_function_graph() without passing $user:

    [graph_image.php:132][2]

    $output = rrdtool_function_graph(get_request_var('local_graph_id'), $rra_id, $graph_data_array);

Hence, permissions are never checked after this commit. I don't think this
is the intended affect.

Now, let's try something: take 1.2.2+ds1-2+deb10u1, the version in buster
which is affected and simply revert cf73ae1a9f65b5a27d7f9d10:

--- a/lib/rrd.php       2019-10-16 13:24:08.590183640 +0200
+++ b/lib/rrd.php       2019-10-16 13:24:34.302046280 +0200
@@ -1171,11 +1171,11 @@

        /* before we do anything; make sure the user has permission to view this graph,
        if not then get out */
-       if ($user > 0) {
+       //if ($user > 0) {
                if (!is_graph_allowed($local_graph_id, $user)) {
                        return 'GRAPH ACCESS DENIED';
                }
-       }
+       //}

        if (getenv('LANG') == '') {
                putenv('LANG=' . str_replace('-', '_', CACTI_LOCALE) . '.UTF-8');

Try to reproduce: this is sufficient to "fix" the issue and appears to
confirm previous analysis.

Any comments?

cheers,
Hugo

[0] https://github.com/Cacti/cacti/commit/cf73ae1a9f65b5a27d7f9d10c8e14835c3a76326
[1] https://github.com/Cacti/cacti/blob/develop/lib/rrd.php#L1179
[2] https://github.com/Cacti/cacti/blob/develop/graph_image.php#L132

-- 
                Hugo Lefeuvre (hle)    |    www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C