CVE-2024-34340: 
Cacti vulnerability analysis and mitigation

CVE-2024-34340 is an authentication bypass vulnerability affecting Cacti, an operational monitoring and fault management framework, prior to version 1.2.27. The vulnerability exists in the compat_password_verify function where md5-hashed user input is compared with the correct password in the database using loose comparison instead of strict comparison (GitHub Advisory, NVD).

The vulnerability stems from the password verification mechanism in Cacti's authentication system. When verifying passwords, Cacti calls compat_password_verify, which uses password_verify if available, otherwise falling back to md5 comparison. The critical flaw lies in the loose comparison (== instead of ===) between the md5-hashed user input and the stored password hash, leading to potential type juggling vulnerabilities. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 CRITICAL (GitHub Advisory).

This vulnerability could allow unauthorized access to Cacti installations running on PHP versions lower than 5.5.0, where the md5 hashing fallback is used. The impact is particularly severe as it could lead to authentication bypass, potentially allowing attackers to gain unauthorized access to the system (Security Online).

The vulnerability is exploitable through type juggling in PHP. Specifically, when password hashes begin with '0e', they can be bypassed using known magic hashes that also begin with '0e', as PHP treats these as scientific notation during loose comparison. Several known magic hash values can be used to exploit this vulnerability (GitHub Advisory).

The vulnerability has been patched in Cacti version 1.2.27. Users are strongly advised to upgrade to this version or later to mitigate the risk. The fix implements proper password hash comparison to prevent type juggling attacks (Fedora Update).