CVE-2024-23119 Overview
CVE-2024-23119 is a SQL injection vulnerability in Centreon Web that permits authenticated remote attackers to execute arbitrary code. The flaw resides in the insertGraphTemplate function, which fails to validate user-supplied input before incorporating it into SQL queries. An attacker with valid credentials can inject malicious SQL statements and achieve code execution in the context of the Centreon service account. The vulnerability is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The issue was reported through the Zero Day Initiative as ZDI-CAN-22339 and disclosed as ZDI-24-113.
Critical Impact
Authenticated attackers can execute arbitrary code on Centreon Web installations, leading to full compromise of the monitoring platform and any credentials or infrastructure data it holds.
Affected Products
- Centreon Centreon Web (multiple versions, see vendor advisory)
- Deployments exposing the Centreon web UI to authenticated users
- Centreon monitoring platforms integrated with enterprise infrastructure
Discovery Timeline
- 2024-04-01 - CVE-2024-23119 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23119
Vulnerability Analysis
Centreon is an open-source IT infrastructure monitoring platform widely deployed in enterprise environments. CVE-2024-23119 exists in the insertGraphTemplate function within the graph template management workflow of Centreon Web. The function concatenates attacker-controlled parameters directly into SQL statements without parameterization or input sanitization.
Exploitation requires authentication, but any account with access to the graph template feature can trigger the flaw. Once triggered, an attacker can manipulate SQL query logic to read, modify, or exfiltrate database contents. Because Centreon stores administrative credentials, host inventory, and polling configuration in its database, tampering with these tables leads to lateral impact across monitored infrastructure.
The SQL injection also enables command execution in the context of the Centreon service account. Attackers can chain database-layer primitives to write files, load malicious modules, or invoke stored procedures, achieving arbitrary code execution on the host.
Root Cause
The root cause is improper neutralization of user-supplied strings before their use in dynamic SQL query construction inside insertGraphTemplate. Standard mitigations such as prepared statements or strict input validation are absent from the affected code path.
Attack Vector
The attack vector is network-based. An authenticated attacker submits a crafted HTTP request to the vulnerable endpoint containing SQL metacharacters. The malformed payload alters the intended query, enabling data manipulation and, ultimately, code execution as the Centreon service user. See the Zero Day Initiative Advisory ZDI-24-113 for additional context.
// No verified public proof-of-concept is available.
// Refer to the ZDI advisory for technical details on the vulnerable
// insertGraphTemplate function and affected parameters.
Detection Methods for CVE-2024-23119
Indicators of Compromise
- HTTP POST requests to Centreon graph template endpoints containing SQL metacharacters such as ', --, UNION SELECT, or INTO OUTFILE
- Unexpected new administrative accounts or modified user roles in the Centreon database
- Files written to disk by the Centreon service account outside normal application directories
- Outbound connections initiated by Centreon web or engine processes to unknown hosts
Detection Strategies
- Inspect Centreon web server access logs for anomalous parameters submitted to graph template management URLs
- Enable MySQL or MariaDB general query logging temporarily to identify malformed statements targeting the graph_templates table
- Correlate authenticated Centreon sessions with subsequent shell or file-write activity by the centreon or apache service accounts
- Deploy web application firewall (WAF) signatures for SQL injection patterns on Centreon endpoints
Monitoring Recommendations
- Alert on process creation events where the Centreon service account spawns interpreters such as sh, bash, python, or perl
- Monitor for modifications to Centreon PHP files, cron entries, and systemd units under the service account
- Track privilege changes and password resets within the Centreon contact table
How to Mitigate CVE-2024-23119
Immediate Actions Required
- Upgrade Centreon Web to a vendor-patched release as referenced in ZDI-24-113
- Restrict access to the Centreon web interface to trusted management networks using firewall or VPN controls
- Audit Centreon user accounts and revoke unnecessary privileges, especially graph template editing rights
- Rotate credentials stored in or accessible through Centreon after patching
Patch Information
Centreon has released fixed versions addressing the SQL injection in insertGraphTemplate. Consult the Zero Day Initiative Advisory ZDI-24-113 and the official Centreon release notes for exact fixed version numbers applicable to your deployment channel.
Workarounds
- Limit graph template management permissions to a minimal set of trusted administrative accounts
- Place the Centreon web UI behind a reverse proxy with SQL injection filtering rules
- Enforce multi-factor authentication on all Centreon administrative accounts to raise the bar for authenticated exploitation
# Example: restrict Centreon web UI to a management subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
