CVE-2024-5725 Overview
CVE-2024-5725 is a SQL injection vulnerability in Centreon Web that leads to remote code execution. The flaw resides in the initCurveList function, which fails to properly validate user-supplied input before constructing SQL queries. Authenticated remote attackers can exploit this issue to execute arbitrary code in the context of the apache user on affected installations. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-22683 and disclosed as ZDI-24-597. Centreon is a widely deployed IT infrastructure monitoring platform, making exploitation attractive to attackers seeking a foothold in enterprise monitoring infrastructure.
Critical Impact
Authenticated attackers can execute arbitrary code on Centreon servers by injecting SQL through the initCurveList function, compromising confidentiality, integrity, and availability of the monitoring platform.
Affected Products
- Centreon Centreon Web (multiple versions prior to the fixed release referenced in Centreon Security Bulletin #3744)
- Deployments exposing the Centreon Web interface to authenticated users
- Environments running Centreon on Apache under the apache service account
Discovery Timeline
- 2024-08-21 - CVE-2024-5725 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5725
Vulnerability Analysis
CVE-2024-5725 is a SQL injection vulnerability [CWE-89] that escalates into remote code execution. The initCurveList function accepts user-supplied input and concatenates it into an SQL statement without adequate validation or parameterization. An authenticated attacker submits crafted input through the affected request path, and the injected SQL is executed by the backend database used by Centreon Web.
Because the Centreon application runs under Apache, successful exploitation yields code execution in the context of the apache user. This access enables the attacker to read configuration files, pivot into monitored systems using stored credentials, and tamper with monitoring data. The EPSS score of 47.368% places this issue in the 98th percentile for exploitation likelihood, indicating elevated real-world risk.
Root Cause
The root cause is the lack of input sanitization and the absence of parameterized queries in the initCurveList function. User-controlled string data flows directly into a dynamic SQL query, allowing an attacker to break out of the intended query context and inject arbitrary SQL syntax.
Attack Vector
The attack vector is network-based and requires low-privilege authentication. An attacker with valid Centreon credentials sends a crafted HTTP request to the vulnerable endpoint. The injected SQL payload is parsed and executed by the database engine, and chained techniques allow the attacker to trigger code execution on the underlying host.
No public proof-of-concept code is verified for this issue. Refer to the Zero Day Initiative Advisory ZDI-24-597 for technical details.
Detection Methods for CVE-2024-5725
Indicators of Compromise
- Unexpected outbound connections or shell processes spawned by the apache user on Centreon servers
- Anomalous SQL statements in database logs containing UNION, SELECT INTO OUTFILE, or stacked queries originating from Centreon Web
- New or modified PHP files under Centreon web directories that were not deployed by administrators
- Authentication events from Centreon accounts followed shortly by unusual database activity
Detection Strategies
- Inspect Centreon and Apache access logs for requests targeting endpoints that invoke initCurveList with suspicious query parameters
- Enable database query logging and alert on parameterized-query violations or SQL syntax anomalies from the Centreon service account
- Correlate authenticated Centreon sessions with process creation events on the host to identify command execution originating from the web tier
Monitoring Recommendations
- Baseline normal Centreon user behavior and alert on deviations such as unusual request patterns or off-hours activity
- Forward Apache, PHP, and MariaDB/MySQL logs to a centralized analytics platform for correlation
- Monitor file integrity across Centreon installation directories to detect webshell placement or unauthorized modification
How to Mitigate CVE-2024-5725
Immediate Actions Required
- Upgrade Centreon Web to the fixed version listed in Centreon Security Bulletin #3744
- Restrict access to the Centreon Web interface to trusted networks using firewall rules or VPN gating
- Review Centreon user accounts and disable or rotate credentials for any accounts that are inactive or over-privileged
- Audit the Centreon host for signs of prior exploitation, including unexpected files owned by the apache user
Patch Information
Centreon has released fixed versions addressed in Centreon Security Bulletin #3744. Administrators should apply the vendor patch as the primary remediation. Additional technical detail is available in the Zero Day Initiative Advisory ZDI-24-597.
Workarounds
- Limit Centreon Web access to a management VLAN or bastion host until patching is complete
- Enforce strong authentication and multi-factor authentication for all Centreon accounts to reduce the pool of potential attackers
- Apply least-privilege configuration to the database account used by Centreon so that injected SQL cannot invoke file-write or command-execution primitives
# Example: restrict Centreon Web to a management subnet via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
