CVE-2019-16194
📋 TL;DR
This CVE describes a SQL injection vulnerability in Centreon monitoring software that allows attackers to execute arbitrary SQL commands via the svc_id parameter. Attackers can potentially access, modify, or delete sensitive database information. All Centreon users running versions through 19.04 are affected.
💻 Affected Systems
- Centreon
📦 What is this software?
Centreon by Centreon
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Centreon database including credential theft, data exfiltration, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized access to monitoring data, configuration information, and potential lateral movement within the network using stolen credentials.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only read access to non-sensitive data.
🎯 Exploit Status
SQL injection via HTTP parameter manipulation requires authentication but is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.04.1 and later
Vendor Advisory: https://github.com/centreon/centreon/releases
Restart Required: Yes
Instructions:
1. Backup Centreon configuration and database. 2. Update to Centreon 19.04.1 or later. 3. Restart Centreon services. 4. Verify the fix by checking version and testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
linuxAdd input validation to filter svc_id parameter to only accept numeric values
Modify include/monitoring/status/Services/xml/makeXMLForOneService.php to validate svc_id as integer
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns in svc_id parameter
Add WAF rule: deny requests with SQL keywords in svc_id parameter
🧯 If You Can't Patch
- Restrict network access to Centreon web interface to trusted IPs only
- Implement database user with minimal required permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Check Centreon version: if <= 19.04, vulnerable. Test endpoint with SQL injection payload in svc_id parameter.Check Version:
rpm -qa | grep centreon-web or check Centreon web interface About pageVerify Fix Applied:
Verify Centreon version is 19.04.1 or later. Test the vulnerable endpoint with SQL injection payloads to confirm they're blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL injection patterns
- HTTP requests with SQL keywords in svc_id parameter
Network Indicators:
- Unusual outbound database connections from web server
- HTTP requests containing SQL injection patterns to vulnerable endpoint
SIEM Query:
source="apache_access" AND uri="*makeXMLForOneService.php*" AND (param="*svc_id=*UNION*" OR param="*svc_id=*SELECT*" OR param="*svc_id=*INSERT*")