CVE-2024-23119: Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Centreon is a software package that provides comprehensive monitoring capabilities for IT infrastructure. It allows users to monitor various aspects of their systems, including network devices, servers, applications, and more. This vulnerability affects Centreon installations and can be exploited by remote attackers to execute arbitrary code. The vulnerability requires authentication to be exploited. The specific flaw exists within the insertGraphTemplate function, where user-supplied strings are not properly validated before being used in SQL queries. This allows an attacker to inject malicious code and execute it within the context of the service account. The vulnerability has a CVSS score of 8.8, indicating a high severity level.

Vulnerability Detail

The vulnerability in Centreon's insertGraphTemplate function arises from the lack of proper validation of user-supplied input. This allows an attacker to craft a malicious string that can be injected into SQL queries. By exploiting this vulnerability, an attacker can execute arbitrary code on the affected Centreon installation. This code will run with the privileges of the service account, potentially leading to further compromise of the system. The vulnerability has been assigned the identifier CVE-2024-23119 and is also tracked as GHSA-626r-cj47-p49g.

composer require centreon/centreon:22.10.15

Workaround

As a temporary workaround, users can implement additional input validation and sanitization measures to mitigate the risk of SQL injection attacks. This can involve using prepared statements or parameterized queries to ensure that user input is properly handled and does not introduce vulnerabilities. Here is an example of using prepared statements in PHP to prevent SQL injection:

$stmt = $pdo->prepare('INSERT INTO graph_templates (name) VALUES (?)');
$stmt->execute([$userInput]);

Conclusion

In conclusion, the Centreon insertGraphTemplate function is vulnerable to SQL injection, allowing remote attackers to execute arbitrary code on affected installations. To mitigate this vulnerability, it is crucial to update Centreon to version 22.10.15 or later and implement proper authentication mechanisms. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for centreon/centreon →

FAQ