CVE-2024-0637 Overview
CVE-2024-0637 is an authenticated SQL injection vulnerability in Centreon Web that allows remote code execution. The flaw resides in the updateDirectory function, which fails to properly validate user-supplied input before incorporating it into SQL queries. An authenticated attacker can leverage this weakness to run arbitrary code in the context of the Centreon service account. The issue is tracked under CWE-89 (SQL Injection) and was reported through the Zero Day Initiative as ZDI-CAN-22294.
Critical Impact
Authenticated attackers can achieve remote code execution on Centreon monitoring servers, compromising the confidentiality, integrity, and availability of monitored infrastructure.
Affected Products
- Centreon Centreon Web (multiple versions listed in vendor advisory)
- Deployments exposing the authenticated management console
- Environments where the updateDirectory endpoint is reachable by low-privileged users
Discovery Timeline
- 2024-04-01 - CVE-2024-0637 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0637
Vulnerability Analysis
Centreon Web exposes an updateDirectory function used to manage LDAP directory configurations. The function accepts user-supplied strings and concatenates them into SQL statements without sufficient sanitization or parameterization. An authenticated attacker with low privileges can inject SQL syntax that alters query semantics. Because Centreon executes helper commands and stored procedures against the same database backend, successful injection escalates from data manipulation to arbitrary code execution under the service account. The CWE-89 classification confirms the root category as improper neutralization of special elements used in an SQL command. Exploitation reach is broad because Centreon deployments frequently hold credentials for monitored assets, magnifying downstream risk.
Root Cause
The root cause is the absence of parameterized queries and input validation inside the updateDirectory handler. User-supplied values flow directly into dynamically constructed SQL statements. The application trusts authenticated input without enforcing type, length, or character restrictions. This design pattern violates secure coding guidance for database access layers.
Attack Vector
Exploitation requires network access to the Centreon Web interface and valid credentials at any privilege tier. The attacker submits a crafted request to the updateDirectory endpoint containing SQL metacharacters embedded in a directory parameter. The injected payload executes within the database session and can be chained with functions that write to disk or invoke OS commands. The result is code execution as the Centreon service user, typically providing broad access to configuration data and monitoring credentials.
No verified public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-24-118 for additional technical context.
Detection Methods for CVE-2024-0637
Indicators of Compromise
- Unexpected POST requests to Centreon endpoints referencing updateDirectory with SQL metacharacters such as single quotes, UNION, or SELECT keywords.
- New or modified files under Centreon web root directories written by the database or Centreon service account.
- Anomalous outbound connections from the Centreon host to attacker-controlled infrastructure shortly after authenticated sessions.
- Database error log entries showing malformed queries originating from directory management functions.
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect requests to Centreon administrative endpoints for SQL injection signatures.
- Enable MySQL or MariaDB general query logging on Centreon backends and alert on syntactically unusual queries from the Centreon application user.
- Correlate authenticated Centreon logins with subsequent process execution on the host to identify RCE follow-on activity.
Monitoring Recommendations
- Monitor /var/log/centreon/ and web server access logs for POST requests to directory management URIs with encoded SQL payloads.
- Track child process creation from the Centreon PHP-FPM or Apache worker processes; shells such as sh, bash, or python are high-signal.
- Alert on modifications to Centreon configuration files and cron entries outside of change windows.
How to Mitigate CVE-2024-0637
Immediate Actions Required
- Upgrade Centreon Web to the fixed release identified in ZDI-24-118 and vendor security bulletins.
- Restrict network access to the Centreon management interface using firewalls or reverse proxies with allow-lists.
- Rotate credentials stored within Centreon, including monitoring account passwords and API tokens, after patching.
- Audit Centreon user accounts and revoke unnecessary or dormant access to reduce the authenticated attack surface.
Patch Information
Centreon has released updated packages addressing the updateDirectory SQL injection. Administrators should consult the Zero Day Initiative Advisory ZDI-24-118 for the fixed version references and apply vendor updates through standard Centreon package channels. Reboot or restart affected services after patch installation to ensure the fixed code paths are loaded.
Workarounds
- Place the Centreon Web console behind a VPN or zero-trust access proxy to limit reachability.
- Apply WAF signatures blocking SQL injection payloads targeting updateDirectory parameters until patching is complete.
- Enforce least privilege on the Centreon database account to reduce the impact of successful injection.
# Example: restrict access to Centreon management interface via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
