Cacti: Automation Networks allows discovery of invalid IP addresses

[MikeSierraRO]

Describe the bug

All of a sudden, I saw that the VM's vCPU it's at 99.9% and I checked the Cacti logs, I found out that I have a lot of errors like: "CMDPHP WARNING: ICMP Ping Error: cacti_gethostbyname failed for 10.118.30163.45"

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

I didn't installed nothing new on Cacti, the Mikrotik plugin and Export to FTP are the only ones that are installed.

[MikeSierraRO]

Forgot to mention, Cacti it's the latest newest stable version Version 1.2.15.

[TheWitness]

What OS? Is SELinux or App Armor enabled?

[MikeSierraRO]

@TheWitness

OS: Debian 9.13
SELinux: not configured
App Armor: not configured

[TheWitness]

Crap, look at your IP addresses, they are invalid...

[TheWitness]

So, the errors are legit.

[MikeSierraRO]

Well, I checked every of my device and that IP Address it's not part of a monitorised device.

So I don't know from where that IP Address it's comming from...

[MikeSierraRO]

@TheWitness here's a screenshot from my devices.

[TheWitness]

You have a network defined in Automation Networks that is kind of in that range. Do me a favor, start a manual scan, and then run the following SQL command:

SELECT ip_address FROM automation_ips;

See if you find some of these bogus IP addresses there. Post the network range definition in the Automation network definition.

[MikeSierraRO]

You're right bro', it was the freaking automation :)).

Never tought about this. I disabled the Automation and deleted those shady devices that I didn't recognized.

Now log is clear. Do I need to keep automation enabled? @TheWitness

[TheWitness]

What were the network ranges? Paste them here. We should add some checks to prevent this. So, paste what was in the range definition, and then we'll fix the badness.

[TheWitness]

Closing this now. Sufficient checks are in place to block these invalid IP's now.

[MikeSierraRO]

I'll post them tomorrow so you can have them.