CVE-2025-54889
📋 TL;DR
This stored XSS vulnerability in Centreon Infra Monitoring allows attackers with elevated privileges to inject malicious scripts into SNMP trap manufacturer configuration pages. When other users view these pages, the scripts execute in their browsers, potentially compromising their sessions or performing unauthorized actions. The vulnerability affects Centreon Infra Monitoring installations running specific vulnerable versions.
💻 Affected Systems
- Centreon Infra Monitoring
📦 What is this software?
Centreon Web by Centreon
Centreon Web by Centreon
Centreon Web by Centreon
⚠️ Risk & Real-World Impact
Worst Case
Privileged attacker compromises administrator accounts, steals session tokens, gains full system control, and pivots to other systems in the network.
Likely Case
Malicious insider or compromised privileged account performs session hijacking, data theft, or modifies monitoring configurations to hide malicious activity.
If Mitigated
Limited to privilege escalation among existing users, with minimal impact if proper input validation and output encoding are implemented.
🎯 Exploit Status
Requires authenticated privileged access; stored XSS payload must be injected into specific configuration fields.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.10.13, 24.04.18, 23.10.28
Vendor Advisory: https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54889-centreon-web-all-versions-medium-severity-5123
Restart Required: No
Instructions:
1. Backup your Centreon configuration and database. 2. Update to patched version via package manager (yum update centreon or apt upgrade centreon). 3. Verify update completed successfully. 4. Test SNMP trap manufacturer configuration functionality.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for SNMP trap manufacturer configuration fields to reject suspicious characters.
# Review and enhance input validation in affected PHP files
# Add HTML entity encoding for output in configuration display pages
🧯 If You Can't Patch
- Restrict privileged access to SNMP trap configuration modules to only essential personnel
- Implement web application firewall (WAF) rules to detect and block XSS payloads in POST requests
🔍 How to Verify
Check if Vulnerable:
Check Centreon version via web interface (Administration > Parameters > Centreon) or command: rpm -qa | grep centreon-webCheck Version:
rpm -q centreon-web || dpkg -l | grep centreon-webVerify Fix Applied:
Confirm version is 24.10.13, 24.04.18, or 23.10.28 or higher; test SNMP trap manufacturer configuration for proper input sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to SNMP trap manufacturer configurations
- Multiple failed login attempts followed by successful privileged access
Network Indicators:
- HTTP POST requests containing script tags or JavaScript in SNMP configuration parameters
SIEM Query:
source="centreon.log" AND ("SNMP trap" OR "manufacturer configuration") AND ("<script>" OR "javascript:" OR "onerror=")