Skip to content

hardening: remove /bin/sh fallback from alert command execution #275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
somethingwithproof wants to merge 4 commits into
base: develop
Choose a base branch
from
+59 −29
Open

hardening: remove /bin/sh fallback from alert command execution #275

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c1b6428
hardening: remove shell fallback from alert command execution
somethingwithproof Mar 7, 2026
27041db
fix: move execute log inside is_executable guard; strip quotes from path
somethingwithproof Mar 7, 2026
a9a887e
fix: distinguish PATH-lookup from missing/non-executable in alert com…
somethingwithproof Mar 7, 2026
818dfc0
chore: add CHANGELOG entry for develop
somethingwithproof Mar 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

--- develop ---

* issue#257: Remove /bin/sh fallback execution path for alert commands
* issue: Making changes to support Cacti 1.3
* issue: Don't use MyISAM for non-analytical tables
* issue: The install advisor for Syslog was broken in current Cacti releases
Expand Down
57 changes: 28 additions & 29 deletions functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1521,23 +1521,23 @@ function syslog_process_alert($alert, $sql, $params, $count, $hostname = '') {
}

if (trim($alert['command']) != '' && !$found) {
$command = alert_replace_variables($alert, $results, $hostname);

$logMessage = "SYSLOG NOTICE: Executing '$command'";

$cparts = explode(' ', $command);

if (is_executable($cparts[0])) {
$command = alert_replace_variables($alert, $results, $hostname);
$cparts = preg_split('/\s+/', trim($command));
/* trim surrounding quotes so paths like "/usr/bin/cmd" resolve correctly */
$executable = trim($cparts[0], '"\'');
$output = array();
$returnCode = 0;

if (cacti_sizeof($cparts) && is_executable($executable)) {
exec($command, $output, $returnCode);
cacti_log("SYSLOG NOTICE: Executing '$command' Command return code: $returnCode", true, 'SYSTEM');
} else {
exec('/bin/sh ' . $command, $output, $returnCode);
$returnCode = 126;
$reason = (strpos($executable, DIRECTORY_SEPARATOR) === false)
? 'PATH-based lookups are not supported; use an absolute path'
: 'file not found or not marked executable';
cacti_log("SYSLOG ERROR: Alert command is not executable: '$command' -- $reason", false, 'SYSTEM');
}

// Append the return code to the log message without the dot
$logMessage .= " Command return code: $returnCode";

// Log the combined message
cacti_log($logMessage, true, 'SYSTEM');
}

}
Expand Down Expand Up @@ -1581,23 +1581,23 @@ function syslog_process_alert($alert, $sql, $params, $count, $hostname = '') {
}

if (trim($alert['command']) != '' && !$found) {
$command = alert_replace_variables($alert, $results, $hostname);

$logMessage = "SYSLOG NOTICE: Executing '$command'";

$cparts = explode(' ', $command);

if (is_executable($cparts[0])) {
$command = alert_replace_variables($alert, $results, $hostname);
$cparts = preg_split('/\s+/', trim($command));
/* trim surrounding quotes so paths like "/usr/bin/cmd" resolve correctly */
$executable = trim($cparts[0], '"\'');
$output = array();
$returnCode = 0;

if (cacti_sizeof($cparts) && is_executable($executable)) {
exec($command, $output, $returnCode);
cacti_log("SYSLOG NOTICE: Executing '$command' Command return code: $returnCode", true, 'SYSTEM');
} else {
exec('/bin/sh ' . $command, $output, $returnCode);
$returnCode = 126;
$reason = (strpos($executable, DIRECTORY_SEPARATOR) === false)
? 'PATH-based lookups are not supported; use an absolute path'
: 'file not found or not marked executable';
cacti_log("SYSLOG ERROR: Alert command is not executable: '$command' -- $reason", false, 'SYSTEM');
}

// Append the return code to the log message without the dot
$logMessage .= " Command return code: $returnCode";

// Log the combined message
cacti_log($logMessage, true, 'SYSTEM');
}
}
}
Expand Down Expand Up @@ -2421,4 +2421,3 @@ function alert_replace_variables($alert, $results, $hostname = '') {

return $command;
}

30 changes: 30 additions & 0 deletions tests/regression/issue257_remove_shell_fallback_test.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
<?php

$functions = file_get_contents(dirname(__DIR__, 2) . '/functions.php');

if ($functions === false) {
fwrite(STDERR, "Failed to load functions.php\n");
exit(1);
}

if (strpos($functions, "exec('/bin/sh ' . \$command") !== false) {
fwrite(STDERR, "Shell fallback execution path is still present.\n");
exit(1);
}

if (preg_match_all('/\bpreg_split\b/', $functions) < 2) {
fwrite(STDERR, "Expected command tokenization update is missing.\n");
exit(1);
}

if (preg_match_all('/\$returnCode\s*=\s*126/', $functions) < 2) {
fwrite(STDERR, "Expected non-executable return code handling is missing.\n");
exit(1);
}

if (preg_match_all('/SYSLOG ERROR: Alert command is not executable/', $functions) < 2) {
fwrite(STDERR, "Expected non-executable command log message is missing.\n");
exit(1);
}

echo "issue257_remove_shell_fallback_test passed\n";