CVE-2019-17647
📋 TL;DR
This SQL injection vulnerability in Centreon monitoring software allows attackers to execute arbitrary SQL commands via the instance parameter in hostXML.php. Affected systems include Centreon versions before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. Successful exploitation could lead to data theft, privilege escalation, or complete system compromise.
💻 Affected Systems
- Centreon
📦 What is this software?
Centreon by Centreon
Centreon by Centreon
Centreon by Centreon
Centreon by Centreon
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to complete system takeover, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized database access allowing extraction of sensitive monitoring data, credentials, and configuration information.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
SQL injection via URL parameter requires minimal technical skill. Authentication may be required depending on configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.30, 18.10.8, 19.04.5, or 19.10.2
Vendor Advisory: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/
Restart Required: Yes
Instructions:
1. Backup your Centreon configuration and database. 2. Update to the patched version using official Centreon update procedures. 3. Restart Centreon services. 4. Verify the fix by checking the version and testing the vulnerable endpoint.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the instance parameter.
# Configure WAF to block patterns like: UNION SELECT, OR 1=1, ';--
# Example ModSecurity rule: SecRule ARGS:instance "@detectSQLi" "id:1001,phase:2,deny"
File Access Restriction
linuxTemporarily restrict access to the vulnerable PHP file.
# Rename or move the vulnerable file:
mv /usr/share/centreon/www/include/monitoring/status/Hosts/xml/hostXML.php /usr/share/centreon/www/include/monitoring/status/Hosts/xml/hostXML.php.disabled
# Or modify permissions:
chmod 000 /usr/share/centreon/www/include/monitoring/status/Hosts/xml/hostXML.php
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Centreon servers from critical systems.
- Deploy intrusion detection systems (IDS) to monitor for SQL injection attempts against Centreon endpoints.
🔍 How to Verify
Check if Vulnerable:
Check if your Centreon version is below the patched versions. Access the vulnerable endpoint with SQL injection test payloads (in a controlled environment).Check Version:
grep 'version' /etc/centreon/centreon.conf.php | head -1Verify Fix Applied:
Verify Centreon version is at or above patched versions. Test the vulnerable endpoint with SQL injection payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to hostXML.php with suspicious parameters
- Error logs showing SQL syntax errors
Network Indicators:
- HTTP requests to /include/monitoring/status/Hosts/xml/hostXML.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="apache_access" AND uri="/include/monitoring/status/Hosts/xml/hostXML.php" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR 1=1*")🔗 References
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30
- https://github.com/centreon/centreon/pull/8063
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30
- https://github.com/centreon/centreon/pull/8063
