CVE-2026-14453

Executive Summary

CVE-2026-14453 is a critical Server-Side Template Injection (SSTI) vulnerability in the Centreon centreon-open-tickets module. The vulnerability allows any authenticated user to inject and execute arbitrary code on the server via the message_confirm field, which is stored without sanitization and rendered using the Smarty template engine with no security policy enabled. This leads to full remote code execution (RCE), disclosure of environment secrets, and potential impact on platform availability of the Centreon Infra Monitoring product. The CVSS score is 9.6, indicating a critical severity. No public exploit code or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.6 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability can be exploited by any authenticated user with low privileges, leading to full server compromise.

Deep Dive & Mechanics

The vulnerability resides in the centreon-open-tickets module, which is used for managing open tickets within Centreon. The message_confirm field is intended to store a confirmation message that is displayed to users after a ticket action. However, this field is stored in the database without any sanitization or escaping. When the message is later rendered, it is processed by the Smarty template engine. By default, Smarty does not enforce a security policy, meaning that template syntax (e.g., {php}, {system}, {exec}) is evaluated as code.

An authenticated attacker can craft a malicious payload in the message_confirm field, such as:

{php}echo shell_exec('id');{/php}

When the message is rendered, Smarty executes the PHP code, resulting in arbitrary command execution on the server.

Attack Flow:

1. Attacker authenticates to Centreon.
2. Attacker navigates to the open tickets configuration and sets a malicious message_confirm value.
3. The value is stored in the database without sanitization.
4. When any user (including the attacker) triggers the display of the confirmation message, Smarty renders the template.
5. The malicious payload is executed, giving the attacker RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the module's configuration handler
$message_confirm = $_POST['message_confirm'];
// No sanitization or escaping
$db->query("INSERT INTO open_tickets_config (message_confirm) VALUES ('$message_confirm')");

Rendering (Vulnerable):

// In the template rendering function
$smarty = new Smarty();
// No security policy set
$smarty->display('string:' . $message_confirm);

Patched Code (Conceptual):

// Sanitize input
$message_confirm = htmlspecialchars($_POST['message_confirm'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO open_tickets_config (message_confirm) VALUES ('$message_confirm')");

Rendering (Patched):

$smarty = new Smarty();
$smarty->setSecurityPolicy(new Smarty_SecurityPolicy($smarty));
$smarty->display('string:' . $message_confirm);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Centreon instance with the centreon-open-tickets module enabled.
• Valid credentials for an authenticated user.

Exploitation Steps:

1. Log in to Centreon.
2. Navigate to Configuration > Open Tickets > Rules.
3. Create or edit a rule and set the message_confirm field to a malicious Smarty payload.
4. Example payload:

   {php}echo shell_exec('whoami');{/php}
   

5. Save the rule.
6. Trigger the display of the confirmation message (e.g., by performing a ticket action).
7. The output of the command will be displayed in the confirmation message.

Advanced Payload:

{php}
$cmd = $_GET['cmd'];
echo shell_exec($cmd);
{/php}

This allows command execution via a GET parameter.

Blue Team

Detection Steps:

1. Monitor for unusual message_confirm values in the database.
2. Look for Smarty template syntax (e.g., {php}, {system}, {exec}) in HTTP POST requests to the open tickets configuration endpoints.
3. Check for unexpected process execution (e.g., whoami, id, curl) from the web server user.
4. Review web server logs for requests containing template syntax.

Hunting Queries:

• Search for {php} or {system} in HTTP request bodies.
• Monitor for outbound connections from the Centreon server to unknown IPs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing {php}, {system}, {exec}, or other Smarty syntax in the message_confirm parameter.
  • Outbound connections from the Centreon server to unknown external IPs (e.g., for data exfiltration).

• File System IOCs:

  • Unexpected files in /tmp/ or web-accessible directories.
  • Modified or new files in the Centreon installation directory.

• Process IOCs:

  • Execution of commands like whoami, id, curl, wget, nc by the web server user (e.g., www-data).

• Log IOCs:

  • Web server logs showing requests with template syntax.
  • Database logs showing unusual message_confirm values.

Detection Engineering

YARA Rule

rule CVE_2026_14453_SSTI_Centreon {
    meta:
        description = "Detects Smarty SSTI payloads in Centreon open tickets module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-14453"
    strings:
        $smarty_php = /{php}.*?{\/php}/s
        $smarty_system = /{system}.*?{\/system}/s
        $smarty_exec = /{exec}.*?{\/exec}/s
        $smarty_include = /{include}.*?{\/include}/s
        $smarty_eval = /{eval}.*?{\/eval}/s
    condition:
        any of them
}

Sigma Rule

title: Centreon Open Tickets SSTI Exploitation
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2026-14453 via Smarty SSTI in Centreon
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'message_confirm'
        cs-body|contains:
            - '{php}'
            - '{system}'
            - '{exec}'
            - '{include}'
            - '{eval}'
    condition: selection
falsepositives:
    - Legitimate use of Smarty syntax in other contexts (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-14453 Centreon Open Tickets SSTI Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"message_confirm"; http_client_body; pcre:"/(\{php\}|\{system\}|\{exec\}|\{include\}|\{eval\})/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the centreon-open-tickets module if not in use.
2. Restrict access to the open tickets configuration pages to only trusted administrators.
3. Implement a Web Application Firewall (WAF) rule to block requests containing Smarty template syntax in the message_confirm parameter.

Long-Term Fix:

1. Apply vendor patch when available.
2. Sanitize input in the message_confirm field using htmlspecialchars() or similar.
3. Enable Smarty security policy to disable dangerous functions like {php}, {system}, {exec}.
4. Use parameterized queries to prevent SQL injection (though not the primary issue here).

Workaround:

• Manually edit the database to remove any malicious message_confirm values.
• Monitor for any signs of compromise.

Valters IT