CVE-2025-12513: Centreon Infra Monitoring XSS Vulnerability

CVE-2025-12513 Overview

CVE-2025-12513 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Centreon Infra Monitoring. The vulnerability exists within the Hosts configuration form modules, where improper neutralization of input during web page generation allows attackers with high privileges to inject malicious scripts that persist in the application. When other users access the affected configuration pages, the stored malicious payload executes in their browser context.

Critical Impact

Attackers with administrative privileges can inject persistent malicious scripts into host configuration forms, potentially compromising other high-privileged users' sessions and enabling further attacks within the monitoring infrastructure.

Affected Products

• Centreon Infra Monitoring from 25.10.0 before 25.10.2
• Centreon Infra Monitoring from 24.10.0 before 24.10.15
• Centreon Infra Monitoring from 24.04.0 before 24.04.19

Discovery Timeline

• 2026-01-05 - CVE-2025-12513 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-12513

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) stems from insufficient input validation and output encoding in the Hosts configuration form modules of Centreon Infra Monitoring. The application fails to properly sanitize user-supplied input before storing it in the database and subsequently rendering it in web pages viewed by other users.

The attack requires network access and high privileges within the Centreon platform, but once exploited, the scope changes beyond the vulnerable component. An attacker can achieve high confidentiality impact by potentially accessing sensitive session data, authentication tokens, and monitoring configuration details from other administrative users who view the compromised host configuration pages.

Root Cause

The root cause is improper neutralization of special characters in user input within the Hosts configuration form modules. When administrators create or modify host configurations, certain input fields do not adequately sanitize HTML and JavaScript content before persisting data to the backend storage. Subsequently, when this data is rendered in the web interface, the malicious content executes in the context of viewing users' browsers.

Attack Vector

The attack leverages network access to the Centreon web interface. An attacker with high-privilege access (such as an administrator or configuration manager role) can inject malicious JavaScript payloads into host configuration fields. These payloads are stored server-side and execute whenever other privileged users access the affected host configuration pages.

The exploitation scenario involves injecting script content into vulnerable form fields within the host configuration interface. When the stored payload is rendered without proper encoding, JavaScript code executes in victim browsers, potentially stealing session cookies, capturing keystrokes, or performing actions on behalf of the authenticated user. For detailed technical information, refer to the Centreon Security Bulletin.

Detection Methods for CVE-2025-12513

Indicators of Compromise

• Unusual JavaScript or HTML content stored in host configuration database fields
• Unexpected script execution detected in browser developer consoles when viewing host configurations
• Anomalous network requests originating from the Centreon web interface to external domains
• Session token exfiltration attempts or unauthorized API calls from user sessions

Detection Strategies

• Implement Content Security Policy (CSP) headers and monitor for violation reports indicating XSS attempts
• Review Centreon application logs for suspicious characters or script tags in host configuration submissions
• Deploy web application firewalls (WAF) with rules to detect XSS payload patterns in form submissions
• Enable SentinelOne Singularity XDR to monitor for anomalous browser behavior and script injection patterns

Monitoring Recommendations

• Configure logging to capture all modifications to host configuration forms and review for malicious content
• Monitor for Content-Security-Policy violation reports in browser error logs
• Set up alerts for database entries containing script tags or JavaScript event handlers in configuration fields
• Track user sessions for unexpected DOM modifications or network requests to untrusted domains

How to Mitigate CVE-2025-12513

Immediate Actions Required

• Update Centreon Infra Monitoring to a patched version: 25.10.2 or later, 24.10.15 or later, or 24.04.19 or later
• Review existing host configurations for potentially injected malicious scripts and sanitize affected entries
• Implement strict Content Security Policy headers to limit script execution sources
• Audit privileged user accounts and enforce principle of least privilege for configuration access

Patch Information

Centreon has released security patches addressing this vulnerability across multiple version branches. Organizations should upgrade to the following minimum versions:

• Version 25.10.2 for the 25.10.x branch
• Version 24.10.15 for the 24.10.x branch
• Version 24.04.19 for the 24.04.x branch

Patch details and release notes are available at the GitHub Centreon Release Notes. The Centreon Security Bulletin provides additional guidance on remediation.

Workarounds

• Restrict access to host configuration forms to only essential administrative personnel until patches can be applied
• Implement additional input validation at the network layer using a web application firewall
• Enable Content-Security-Policy headers with strict script-src directives to prevent inline script execution
• Monitor and audit all configuration changes made by privileged users

# Example Apache configuration to add CSP headers for Centreon
# Add to Centreon virtual host configuration
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
</IfModule>