CVE-2021-26804: Centreon Web Auth Bypass Vulnerability

CVE-2021-26804 Overview

CVE-2021-26804 is an Insecure Permissions vulnerability affecting Centreon Web, a popular network monitoring solution. The vulnerability allows remote attackers to bypass file upload validation by changing any file extension to .gif, then uploading it through the "Administration/Parameters/Images" section of the application. This file extension bypass can enable attackers with authenticated access to upload potentially malicious files to the server.

Critical Impact

Authenticated attackers can bypass file upload restrictions and upload arbitrary files disguised with .gif extensions, potentially leading to further compromise of the Centreon monitoring platform.

Affected Products

• Centreon Web version 19.10.18
• Centreon Web version 20.04.8
• Centreon Web version 20.10.2

Discovery Timeline

• May 4, 2021 - CVE-2021-26804 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-26804

Vulnerability Analysis

This vulnerability stems from improper permission and validation controls in the file upload functionality of Centreon Web. The application fails to properly validate file types based on their actual content (magic bytes), instead relying solely on file extension checking that can be trivially bypassed. When a user navigates to the Administration/Parameters/Images section, the upload functionality allows files to be uploaded as long as they have a .gif extension, regardless of the actual file content.

The weakness is classified as CWE-276 (Incorrect Default Permissions), indicating that the application does not properly restrict what types of files can be uploaded and stored. An authenticated attacker can leverage this flaw to upload files containing malicious content while using the .gif extension to evade validation checks.

Root Cause

The root cause of this vulnerability lies in insufficient file type validation within the Centreon Web image upload functionality. The application relies on file extension-based validation rather than examining the actual content or MIME type of uploaded files. This design flaw allows attackers to bypass intended restrictions simply by renaming malicious files with a .gif extension before upload.

Attack Vector

The attack requires network access and authenticated credentials to the Centreon Web application. Once authenticated, an attacker can navigate to the Administration/Parameters/Images section and upload arbitrary files by simply changing the file extension to .gif. The attack flow involves:

1. Authenticating to the Centreon Web interface with valid credentials
2. Navigating to the Administration/Parameters/Images upload section
3. Renaming a malicious file with a .gif extension
4. Uploading the disguised file through the web interface
5. The file is accepted and stored on the server despite not being a valid GIF image

For technical details on the exploitation mechanism, refer to the Medium Blog Post on Centreon Vulnerability.

Detection Methods for CVE-2021-26804

Indicators of Compromise

• Presence of files with .gif extension in the Centreon images directory that are not valid GIF images
• Unusual file uploads in the Administration/Parameters/Images section by authenticated users
• Web server logs showing repeated POST requests to the image upload endpoint with suspicious file names

Detection Strategies

• Implement file integrity monitoring on the Centreon Web images directory to detect unauthorized file additions
• Review web application logs for unusual upload activity to the Administration/Parameters/Images endpoint
• Use MIME type validation tools to identify files that don't match their declared extension
• Deploy web application firewalls (WAF) rules to inspect uploaded file content

Monitoring Recommendations

• Enable detailed logging for the Centreon Web administration interface
• Monitor for new file creations in the images upload directory with automated alerting
• Implement regular security audits of uploaded content to identify potentially malicious files

How to Mitigate CVE-2021-26804

Immediate Actions Required

• Upgrade Centreon Web to the latest patched version immediately
• Review and audit all files currently stored in the images upload directory
• Restrict access to the Administration/Parameters/Images section to only essential personnel
• Implement network-level access controls to limit who can reach the Centreon Web administration interface

Patch Information

Organizations running affected versions of Centreon Web (19.10.18, 20.04.8, 20.10.2) should upgrade to newer versions that address this file upload validation bypass vulnerability. Consult the official Centreon documentation and release notes for the latest secure versions and upgrade procedures.

Workarounds

• Implement server-side MIME type validation that checks actual file content rather than relying on extensions
• Configure the web server to prevent execution of uploaded files regardless of extension
• Add additional access controls to restrict who can access the image upload functionality
• Deploy a web application firewall (WAF) with rules to inspect uploaded file content for malicious payloads

# Configuration example - Restrict execution in upload directory (Apache)
<Directory "/path/to/centreon/images">
    # Disable script execution
    Options -ExecCGI
    RemoveHandler .php .phtml .php3 .php4 .php5
    php_flag engine off
</Directory>