CVE-2021-28053
📋 TL;DR
This SQL injection vulnerability in Centreon-Web allows authenticated attackers to execute arbitrary SQL commands through the Additional Information parameters in the user configuration interface. It affects Centreon Platform 20.10.0 installations, potentially compromising the entire monitoring database and system.
💻 Affected Systems
- Centreon Platform
📦 What is this software?
Centreon by Centreon
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation to administrative access, and potential remote code execution on underlying systems.
Likely Case
Unauthorized access to sensitive monitoring data, configuration manipulation, and potential lateral movement within the Centreon infrastructure.
If Mitigated
Limited to authenticated user's permissions, with database-level controls preventing data destruction or system takeover.
🎯 Exploit Status
SQL injection via web interface parameters, requires authenticated access but trivial to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.04.13
Vendor Advisory: https://github.com/centreon/centreon/releases/tag/20.04.13
Restart Required: Yes
Instructions:
1. Backup Centreon configuration and database. 2. Update to Centreon 20.04.13 or later. 3. Restart Centreon services. 4. Verify web interface functionality.
🔧 Temporary Workarounds
Input Validation Filter
linuxImplement web application firewall rules to filter SQL injection patterns in Additional Information parameters
# Example mod_security rule: SecRule ARGS:additional_info "@detectSQLi" "id:1001,phase:2,deny,status:403"
Access Restriction
allRestrict access to Configuration > Users > Contacts / Users interface to only necessary administrative users
# Apache example: <Location "/centreon/main.php?p=501"> Require ip 10.0.0.0/8 </Location>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Centreon servers from critical infrastructure
- Enable database auditing and implement real-time SQL query monitoring for injection patterns
🔍 How to Verify
Check if Vulnerable:
Check Centreon version via web interface Admin > About or command: rpm -qa | grep centreon-webCheck Version:
rpm -qa | grep centreon-web | grep -E 'centreon-web-20'Verify Fix Applied:
Verify version is 20.04.13 or later and test Additional Information field with SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by configuration access
- SQL syntax errors in web server logs from /centreon/main.php
Network Indicators:
- POST requests to /centreon/main.php?p=501 with SQL keywords in parameters
- Unusual database connections from web server IP
SIEM Query:
source="apache_access" AND uri="/centreon/main.php" AND (query="*p=501*" AND (query="*UNION*" OR query="*SELECT*" OR query="*INSERT*"))