CVE-2024-55573
📋 TL;DR
A critical SQL injection vulnerability in Centreon centreon-web allows authenticated users with high privileges to inject malicious SQL queries when creating virtual metrics. This affects Centreon monitoring platform users running vulnerable versions, potentially leading to complete database compromise.
💻 Affected Systems
- Centreon centreon-web
📦 What is this software?
Centreon Web by Centreon
Centreon Web by Centreon
Centreon Web by Centreon
Centreon Web by Centreon
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, or deletion; potential privilege escalation to full system control via database functions.
Likely Case
Unauthorized data access, modification of monitoring configurations, potential lateral movement within the database environment.
If Mitigated
Limited impact if proper privilege separation exists and database permissions are restricted, though SQL injection could still affect accessible data.
🎯 Exploit Status
Exploitation requires authenticated high-privilege access to the web interface and knowledge of SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.10.3, 24.04.9, 23.10.19, 23.04.24
Vendor Advisory: https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55573-centreon-web-critical-severity-4264
Restart Required: Yes
Instructions:
1. Backup Centreon configuration and database. 2. Update to patched version via package manager (yum update centreon-web). 3. Restart Centreon services (systemctl restart centreon). 4. Verify update via web interface version check.
🔧 Temporary Workarounds
Restrict Virtual Metrics Access
linuxTemporarily remove or restrict access to virtual metrics creation functionality for non-essential users.
# Modify Centreon ACLs to restrict access to virtual metrics module
# Check Centreon documentation for specific ACL configuration
Database Input Validation
linuxImplement additional input validation at application or WAF level for virtual metrics parameters.
# Configure web application firewall rules to block SQL injection patterns
# Example mod_security rule: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement strict principle of least privilege: review and reduce high-privilege user accounts to absolute minimum.
- Deploy web application firewall with SQL injection detection rules in front of Centreon web interface.
🔍 How to Verify
Check if Vulnerable:
Check Centreon web interface version via Administration > About, or run: rpm -qa | grep centreon-webCheck Version:
rpm -q centreon-web --queryformat '%{VERSION}-%{RELEASE}\n'Verify Fix Applied:
Confirm version is 24.10.3, 24.04.9, 23.10.19, or 23.04.24 or higher via web interface or package manager.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs from Centreon application user
- Multiple failed or unusual virtual metrics creation attempts in Centreon logs
Network Indicators:
- Unusual database connection patterns from Centreon application server
- SQL error messages in HTTP responses
SIEM Query:
source="centreon.log" AND "virtual.*metric" AND (error OR sql OR injection)