CVE-2024-23115 Overview
CVE-2024-23115 is a SQL injection vulnerability in Centreon Web that enables authenticated remote attackers to execute arbitrary code on affected installations. The flaw resides in the updateGroups function, which fails to properly validate user-supplied input before constructing SQL queries [CWE-89]. Successful exploitation allows an attacker to run code in the context of the service account running Centreon. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-22295. The Exploit Prediction Scoring System places this issue in the top tier of exploitation likelihood, reflecting active interest from threat actors.
Critical Impact
Authenticated attackers can inject SQL into the updateGroups function to execute arbitrary code as the Centreon service account, resulting in full compromise of the monitoring server.
Affected Products
- Centreon Web (multiple versions prior to the vendor fix)
- Deployments exposing the Centreon administrative interface to authenticated users
- Centreon monitoring platforms using vulnerable updateGroups handling
Discovery Timeline
- 2024-04-01 - CVE-2024-23115 published to NVD following the Zero Day Initiative Advisory ZDI-24-117
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23115
Vulnerability Analysis
The vulnerability exists within the updateGroups function inside Centreon Web. The function accepts a user-supplied string and incorporates it directly into a SQL query without sufficient validation or parameterization. An authenticated attacker with access to the affected feature can craft input that breaks out of the intended query context. This yields arbitrary SQL execution against the Centreon backend database.
Because Centreon relies on database-driven configuration and can execute logic based on stored values, SQL injection in this code path escalates beyond data exposure. An attacker can pivot from database manipulation to arbitrary code execution in the context of the Centreon service account. Compromise of the service account grants control over monitoring data, credentials stored for polled hosts, and downstream infrastructure targets.
Root Cause
The root cause is missing input sanitization in the updateGroups function. User-controlled data is concatenated into SQL statements rather than passed through parameterized queries or prepared statements. This is a classic instance of [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
Attack Vector
Exploitation requires network access to the Centreon web interface and valid credentials with permission to invoke the updateGroups code path. The attacker sends crafted parameters through the vulnerable endpoint. Injected SQL is executed by the backend database, and follow-on payloads escalate the injection into command execution against the underlying host.
No verified public proof-of-concept code is available for this issue. Refer to the Zero Day Initiative Advisory ZDI-24-117 for further technical detail.
Detection Methods for CVE-2024-23115
Indicators of Compromise
- Unexpected authenticated requests to Centreon endpoints handling group updates containing SQL metacharacters such as ', --, UNION, or SLEEP(
- New or modified operating system files, cron entries, or scheduled tasks owned by the Centreon service account
- Outbound connections initiated by the Centreon service account to unknown hosts following administrative activity
Detection Strategies
- Inspect Centreon web server access logs for POST requests targeting the updateGroups handler with anomalous payload sizes or SQL syntax
- Correlate authenticated Centreon sessions with subsequent shell command execution by the Centreon service account
- Alert on database query patterns produced by the Centreon user that include stacked statements or INTO OUTFILE clauses
Monitoring Recommendations
- Enable verbose audit logging on the MariaDB or MySQL instance backing Centreon and forward events to a central SIEM
- Monitor the Centreon service account for process creation events involving sh, bash, perl, or python
- Review privileged user activity inside Centreon on a recurring basis and revoke unused administrative roles
How to Mitigate CVE-2024-23115
Immediate Actions Required
- Apply the fixed Centreon Web release referenced in the Zero Day Initiative Advisory ZDI-24-117 as soon as it is available in your environment
- Restrict network access to the Centreon administrative interface using firewall rules or VPN gating
- Rotate credentials for all administrative Centreon accounts and audit accounts with access to the group management functions
Patch Information
Centreon has published fixed releases addressing the SQL injection in the updateGroups function. Consult the vendor advisory referenced through the Zero Day Initiative Advisory ZDI-24-117 for the specific fixed version applicable to your deployment. Upgrade all Centreon Web nodes and validate that database schema migrations complete successfully.
Workarounds
- Limit the number of accounts that can invoke group management functionality until the patch is applied
- Place a web application firewall in front of Centreon and block payloads containing SQL keywords in group-related parameters
- Isolate the Centreon backend database on a dedicated network segment with strict egress filtering to reduce impact if injection succeeds
# Example iptables rule restricting Centreon web access to an admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
