CVE-2024-5723: Centreon Web SQL Injection RCE Vulnerability

CVE-2024-5723 Overview

CVE-2024-5723 is a SQL injection vulnerability in Centreon Web that allows authenticated remote attackers to execute arbitrary code on affected installations. The flaw resides in the updateServiceHost function, which fails to properly validate user-supplied input before incorporating it into SQL queries. Successful exploitation grants code execution in the context of the apache user. The Zero Day Initiative tracked this issue as ZDI-CAN-23294 and published advisory ZDI-24-595. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can chain SQL injection into remote code execution as the apache user, exposing monitoring data and enabling lateral movement across managed infrastructure.

Affected Products

Centreon Web (see vendor advisory for affected version ranges)
Centreon monitoring platform deployments exposing the web interface
Environments using vulnerable updateServiceHost service configuration workflows

Discovery Timeline

2024-08-21 - CVE-2024-5723 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5723

Vulnerability Analysis

The vulnerability exists in the updateServiceHost function within Centreon Web. This function processes service-to-host association updates through the monitoring platform's configuration interface. The function accepts user-supplied string data and concatenates it directly into SQL statements without adequate sanitization or parameterization.

An authenticated attacker with access to the Centreon web interface can craft malicious input that breaks out of the intended SQL query context. The injected SQL then executes with the database privileges assigned to the Centreon application. Because Centreon's architecture allows writing configuration files and executing operating system commands through database-backed workflows, attackers can escalate SQL injection into arbitrary code execution as the apache user running the web server.

The vulnerability requires low-privilege authentication but no user interaction. It carries an EPSS score of 40.669% (98.519 percentile), indicating a comparatively high likelihood of exploitation attempts relative to the broader CVE population.

Root Cause

The root cause is the absence of prepared statements or parameterized queries in the updateServiceHost code path. User input flows directly into dynamically constructed SQL, violating the standard defensive pattern for database interaction and enabling [CWE-89] injection.

Attack Vector

Exploitation occurs over the network against the Centreon web application. An attacker authenticates with valid credentials, then submits crafted parameters to the endpoint invoking updateServiceHost. The malicious SQL payload manipulates query logic, extracts data, or writes attacker-controlled content that the platform subsequently interprets as executable code under the apache user context.

See the Zero Day Initiative advisory ZDI-24-595 for technical details on the vulnerable code path.

Detection Methods for CVE-2024-5723

Indicators of Compromise

Unexpected outbound network connections initiated by the apache user or PHP processes on Centreon servers
Anomalous child processes spawned from the Centreon web server, particularly shell interpreters or reconnaissance utilities
Modifications to Centreon configuration files, cron entries, or web-accessible directories outside normal administrative windows
Suspicious HTTP POST requests to service-host configuration endpoints containing SQL metacharacters such as ', --, UNION, or INTO OUTFILE

Detection Strategies

Enable verbose query logging on the Centreon MariaDB/MySQL backend and alert on statements containing injection patterns targeting service-host tables
Deploy web application firewall rules that inspect POST bodies to Centreon configuration endpoints for SQL injection signatures
Correlate authenticated Centreon user sessions with unusual database write patterns or process spawning from the web server

Monitoring Recommendations

Baseline normal behavior of the apache user on Centreon hosts and alert on deviations such as new binaries, network listeners, or credential access
Monitor Centreon application logs for repeated failed configuration updates followed by successful ones from the same session
Track authentication events for Centreon accounts and flag privilege changes or new administrative account creation

How to Mitigate CVE-2024-5723

Immediate Actions Required

Upgrade Centreon Web to a patched release as identified in the ZDI-24-595 advisory and Centreon vendor guidance
Restrict network access to the Centreon web interface to trusted administrative networks and VPN endpoints only
Rotate credentials for all Centreon accounts, especially those with configuration privileges, and audit account activity
Review web server and database logs for prior exploitation attempts against updateServiceHost or related endpoints

Patch Information

Centreon has released updated versions addressing the SQL injection in updateServiceHost. Administrators should consult the Zero Day Initiative advisory and Centreon's official release notes to identify the fixed version applicable to their deployment channel. Apply the update through the standard Centreon package management workflow and verify version strings post-upgrade.

Workarounds

Limit Centreon user permissions so that only trusted administrators can invoke service-host configuration workflows
Place the Centreon web interface behind a reverse proxy with authentication and a WAF ruleset tuned to block SQL injection payloads
Enforce network segmentation so that a compromised Centreon host cannot reach sensitive infrastructure beyond its monitoring scope
Enable database-level auditing on the Centreon schema to preserve forensic evidence of injection attempts

bash

# Example: restrict access to Centreon web interface via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify Centreon package version after patching
rpm -qa | grep -i centreon