CVE-2019-17645
📋 TL;DR
This vulnerability in Centreon monitoring software allows unauthenticated attackers to access sensitive configuration information via a direct request to a specific PHP file. Affected organizations are those running vulnerable Centreon versions without proper access controls.
💻 Affected Systems
- Centreon
📦 What is this software?
Centreon by Centreon
Centreon by Centreon
Centreon by Centreon
Centreon by Centreon
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain sensitive configuration data including service credentials, monitoring parameters, and system information that could lead to further compromise of the monitoring infrastructure.
Likely Case
Information disclosure of monitoring configuration details, potentially exposing internal network structure and service dependencies.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the Centreon web interface.
🎯 Exploit Status
Simple HTTP GET request to the vulnerable endpoint can trigger the information disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.31, 18.10.9, 19.04.6, or 19.10.3 depending on your version track
Vendor Advisory: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/
Restart Required: Yes
Instructions:
1. Identify your Centreon version. 2. Backup your configuration. 3. Update to the patched version for your track. 4. Restart Centreon services. 5. Verify the fix.
🔧 Temporary Workarounds
Block direct access to vulnerable endpoint
linuxUse web server configuration to block access to the specific vulnerable PHP file
# For Apache: Add to .htaccess or virtual host config
<Files "refreshMacroAjax.php">
Require all denied
</Files>
# For Nginx: Add to server block
location ~ /include/configuration/configObject/service/refreshMacroAjax\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict network access controls to limit Centreon web interface access to authorized users only
- Monitor access logs for requests to the vulnerable endpoint and investigate any unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to access https://[centreon-server]/centreon/include/configuration/configObject/service/refreshMacroAjax.php without authentication. If it returns configuration data, the system is vulnerable.Check Version:
Check Centreon web interface login page footer or run: rpm -qa | grep centreon-webVerify Fix Applied:
After patching, attempt the same access and verify you receive an authentication prompt or access denied error instead of configuration data.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /include/configuration/configObject/service/refreshMacroAjax.php from unauthenticated sources
- Unusual access patterns to Centreon configuration endpoints
Network Indicators:
- Unusual HTTP traffic to Centreon web interface from unexpected sources
- Information disclosure in HTTP responses
SIEM Query:
web_access_logs WHERE url_path LIKE '%refreshMacroAjax.php%' AND auth_status = 'unauthenticated'🔗 References
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30
- https://github.com/centreon/centreon/pull/8035
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30
- https://github.com/centreon/centreon/pull/8035
