How to remediate – Cacti Detection

1. Introduction

Cacti Detection indicates a graphing application is running on your web server. Cacti tracks system statistics like CPU load and network bandwidth, which can be useful for monitoring but also presents an attack surface. Affected systems are typically those hosting websites or network infrastructure. A successful exploit could allow attackers to gain unauthorized access to the server and potentially compromise confidentiality, integrity, and availability of data.

2. Technical Explanation

Cacti is a web-based front-end for RRDtool. The vulnerability lies in having an unnecessary application installed on a web server. Attackers can exploit this by attempting to access Cacti’s interface, potentially discovering vulnerabilities within the application itself or using it as a foothold for further attacks. There are no known CVEs specifically for ‘Cacti Detection’, but any unpatched version of Cacti is vulnerable to known exploits. For example, an attacker could attempt to leverage default credentials or known code injection flaws in older versions.

• Root cause: The presence of a web-based graphing application on the server introduces unnecessary risk.
• Exploit mechanism: An attacker attempts to access Cacti’s interface and exploit vulnerabilities within it, such as weak authentication or remote code execution.
• Scope: Any system running an instance of Cacti is potentially affected.

3. Detection and Assessment

To confirm if a system is vulnerable, check for the presence of Cacti on your web server. A quick check involves examining running processes or web application directories.

• Quick checks: Use the command ps -ef | grep cacti to see if any Cacti processes are running.
• Scanning: Nessus plugin ID 16539 can detect Cacti installations, but results should be verified manually.
• Logs and evidence: Web server access logs may show requests for Cacti’s directories (e.g., /cacti/).

ps -ef | grep cacti

4. Solution / Remediation Steps

To fix the issue, remove Cacti from your web server.

4.1 Preparation

• Ensure you have a rollback plan in case of issues: restore the backup if needed.
• A change window may be required depending on your environment and impact assessment.

4.2 Implementation

1. Step 1: Remove Cacti files from the web server directory (e.g., /var/www/html/cacti/).
2. Step 2: Remove any associated database tables or configurations used by Cacti.
3. Step 3: Restart the web server service to apply changes.

4.3 Config or Code Example

Before

# Directory listing showing Cacti files
ls /var/www/html/cacti/

After

# Directory listing showing no Cacti files
ls /var/www/html/cacti/ 

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue.

• Practice 1: Least privilege – only install software that is absolutely necessary for the server’s function.
• Practice 2: Regular security audits – periodically review installed software and remove unused applications.

4.5 Automation (Optional)

#!/bin/bash
# Remove Cacti files - use with caution!
rm -rf /var/www/html/cacti/*
systemctl restart apache2 # or nginx, depending on your server

5. Verification / Validation

Confirm the fix by verifying that Cacti is no longer accessible and that associated processes are stopped.

• Post-fix check: Run ps -ef | grep cacti; there should be no output.
• Re-test: Attempt to access the Cacti interface in a web browser; you should receive an error (e.g., 404 Not Found).
• Smoke test: Verify that other website functionality remains operational.
• Monitoring: Check web server logs for any residual requests related to Cacti.

ps -ef | grep cacti

6. Preventive Measures and Monitoring

Implement preventive measures to avoid similar issues in the future.

• Baselines: Update your server baseline or security policy to explicitly prohibit unnecessary software installations.
• Pipelines: Integrate automated scanning tools into your CI/CD pipeline to detect unauthorized software deployments.
• Asset and patch process: Implement a regular asset inventory and review process to identify and remove unused applications.

7. Risks, Side Effects, and Roll Back

Removing Cacti may disrupt any monitoring or reporting that relies on its data.

• Risk or side effect 1: Loss of historical system statistics if not backed up.
• Risk or side effect 2: Potential disruption to dependent applications or services.
• Roll back: Restore the Cacti files and configurations from your backup, then restart the web server service.

8. References and Resources

• Vendor advisory or bulletin: https://www.cacti.net/