CVE-2024-55573 Overview
CVE-2024-55573 is a SQL injection vulnerability [CWE-89] in Centreon centreon-web, the IT infrastructure monitoring platform. The flaw resides in the form used to create virtual metrics. An authenticated user with high privileges can inject arbitrary SQL statements through this form. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying database. Affected releases include 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, and 23.04.x before 23.04.24.
Critical Impact
A privileged authenticated attacker can execute arbitrary SQL queries against the Centreon backend database, enabling data exfiltration, tampering with monitoring records, and potential lateral movement within the monitoring environment.
Affected Products
- Centreon centreon-web24.10.x before 24.10.3
- Centreon centreon-web24.04.x before 24.04.9
- Centreon centreon-web23.10.x before 23.10.19 and 23.04.x before 23.04.24
Discovery Timeline
- 2025-01-23 - CVE-2024-55573 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55573
Vulnerability Analysis
Centreon centreon-web provides a web interface for configuring monitoring objects, including virtual metrics that combine data from multiple performance sources. The virtual metrics creation form fails to properly sanitize user-supplied input before incorporating it into SQL statements. An authenticated user with high privileges can craft input that breaks out of the intended query context and executes attacker-controlled SQL. The impact extends across confidentiality, integrity, and availability because Centreon stores configuration, credentials, and historical monitoring data in the same database backend.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Input from the virtual metrics form is concatenated into database queries without parameterization or strict validation. Any user permitted to create virtual metrics can therefore alter the intended query structure.
Attack Vector
Exploitation requires network access to the Centreon web interface and valid credentials for an account with the privilege to create virtual metrics. The attacker submits a request to the virtual metrics creation endpoint containing malicious SQL fragments. No user interaction beyond the attacker's own authenticated session is required. See the Centreon Security Bulletin CVE-2024-55573 for advisory details.
Detection Methods for CVE-2024-55573
Indicators of Compromise
- Unexpected POST requests to Centreon virtual metrics configuration endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in form parameters.
- Database error messages returned by centreon-web referencing malformed SQL near virtual metric field values.
- New or modified administrative accounts and unexpected changes to Centreon configuration tables following virtual metric activity.
Detection Strategies
- Inspect Centreon web server access logs for requests to virtual metric creation URLs with suspicious query parameters or oversized payloads.
- Enable MariaDB or MySQL general query logging temporarily and review queries originating from the Centreon application user for anomalous structures.
- Correlate high-privilege user session activity with configuration changes to detect abuse of legitimate accounts.
Monitoring Recommendations
- Alert on Centreon administrative logins from unusual source addresses or outside normal working hours.
- Monitor for privilege changes and new virtual metric definitions in the Centreon audit log.
- Track database read volume from the Centreon application account to identify bulk data extraction.
How to Mitigate CVE-2024-55573
Immediate Actions Required
- Upgrade centreon-web to 24.10.3, 24.04.9, 23.10.19, or 23.04.24 or later, matching your deployed branch.
- Review and reduce the set of accounts that hold privileges to create or modify virtual metrics.
- Rotate credentials for any Centreon administrative accounts that could have been abused prior to patching.
Patch Information
Centreon addressed the vulnerability in centreon-web versions 24.10.3, 24.04.9, 23.10.19, and 23.04.24. Refer to the Centreon Release Notes and the Centreon Security Bulletin CVE-2024-55573 for the full list of fixes and upgrade procedures.
Workarounds
- Restrict network access to the Centreon web interface using a reverse proxy or firewall allow-list until patching is complete.
- Temporarily remove the virtual metrics management privilege from non-essential administrator accounts.
- Enable web application firewall rules that block requests containing SQL metacharacters targeted at Centreon configuration endpoints.
# Example: verify installed centreon-web version on a Centreon Central server
rpm -q centreon-web
# Example: restrict access to the Centreon web UI to a management subnet
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port protocol="tcp" port="443" accept'
firewall-cmd --reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
