CVE-2025-54893
📋 TL;DR
This stored XSS vulnerability in Centreon Infra Monitoring allows authenticated users with elevated privileges to inject malicious scripts into host template configuration pages. When other users view these pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. Affected versions include 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27.
💻 Affected Systems
- Centreon Infra Monitoring
📦 What is this software?
Centreon Web by Centreon
Centreon Web by Centreon
Centreon Web by Centreon
⚠️ Risk & Real-World Impact
Worst Case
Privileged attacker steals administrator credentials, gains full system control, and compromises the entire monitoring infrastructure.
Likely Case
Malicious insider or compromised privileged account steals session cookies, escalates privileges, or performs unauthorized configuration changes.
If Mitigated
Limited to data theft from users viewing infected pages, with no system compromise if proper input validation is in place.
🎯 Exploit Status
Requires authenticated privileged access and knowledge of XSS payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.10.13, 24.04.18, 23.10.28
Vendor Advisory: https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54893-centreon-web-all-versions-medium-severity-5120
Restart Required: No
Instructions:
1. Backup your Centreon configuration. 2. Update to patched version via package manager or manual installation. 3. Verify update completed successfully.
🔧 Temporary Workarounds
Restrict Privileged Access
allLimit host template configuration permissions to only essential administrators.
Implement WAF Rules
allDeploy web application firewall rules to block XSS payloads in host template parameters.
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all host template fields
- Enable Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check Centreon version via web interface or command line. If version falls within affected ranges, system is vulnerable.Check Version:
centreon -v or check web interface About pageVerify Fix Applied:
Verify version is 24.10.13, 24.04.18, or 23.10.28 or higher. Test host template configuration for script injection.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to host templates
- Suspicious characters in configuration parameters
Network Indicators:
- Unexpected JavaScript in HTTP responses from host template pages
SIEM Query:
source="centreon" AND (event="template_modification" AND parameters CONTAINS "<script>")