CVE-2025-54890 Overview
CVE-2025-54890 is a stored cross-site scripting (XSS) vulnerability in the Hostgroup configuration page of Centreon Infra Monitoring. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Authenticated users with elevated privileges can inject malicious script content that persists in the application and executes when other users view the affected page.
The issue affects Centreon Web versions from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19, and from 23.10.0 before 23.10.29. Centreon released patched versions and published a security bulletin documenting the fix.
Critical Impact
Stored XSS payloads persist within the Hostgroup configuration and execute in the browsers of administrators or operators who visit the affected page, enabling session context abuse within the Centreon Web interface.
Affected Products
- Centreon Infra Monitoring (centreon_web) 24.10.0 before 24.10.15
- Centreon Infra Monitoring (centreon_web) 24.04.0 before 24.04.19
- Centreon Infra Monitoring (centreon_web) 23.10.0 before 23.10.29
Discovery Timeline
- 2025-12-22 - CVE-2025-54890 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54890
Vulnerability Analysis
The vulnerability resides in the Hostgroup configuration page within Centreon Web. Input submitted through this configuration workflow is stored and later rendered back to users without adequate output encoding or sanitization. When a subsequent user loads the page, the injected script executes in the context of that user's authenticated Centreon session.
Exploitation requires an authenticated account with elevated privileges to reach the Hostgroup configuration interface, plus user interaction from a victim who navigates to the affected page. Because the payload is stored server-side, it persists across sessions until the offending Hostgroup entry is corrected or removed.
The scope-changed nature of the flaw means script execution can affect components beyond the vulnerable input handler, including administrative views rendered in the same browser context. Impact is limited to confidentiality and integrity of data accessible through the victim's session.
Root Cause
The root cause is missing or insufficient output encoding when rendering Hostgroup configuration fields into HTML. User-controlled data flows from persistent storage into the rendered page without escaping characters that carry meaning in HTML or JavaScript contexts, allowing script tags or event-handler attributes to break out of intended data contexts.
Attack Vector
An attacker with a high-privilege Centreon account submits a crafted payload through the Hostgroup configuration form. The payload is stored in the Centreon database. When another user with access to the configuration page loads it, the browser parses the injected content as executable script. The attacker can then trigger actions using the victim's session, exfiltrate data displayed in the interface, or pivot to other Centreon functions.
The vulnerability is described in prose only; no verified public proof-of-concept has been referenced by the vendor advisory. See the Centreon Security Bulletin CVE-2025-54890 for vendor details.
Detection Methods for CVE-2025-54890
Indicators of Compromise
- Hostgroup names or descriptions containing HTML tags, <script> elements, javascript: URIs, or event handler attributes such as onerror= and onload=.
- Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after loading Centreon Hostgroup configuration pages.
- Audit log entries showing Hostgroup create or update actions performed by accounts that do not normally manage monitoring configuration.
Detection Strategies
- Review the Centreon database tables backing Hostgroup configuration for stored values containing HTML or JavaScript metacharacters.
- Inspect web server access logs for POST requests to Hostgroup configuration endpoints with payloads containing angle brackets or script keywords.
- Correlate privileged user activity in Centreon audit logs with subsequent unusual session behavior from administrator accounts.
Monitoring Recommendations
- Enable and centralize Centreon Web audit logging for configuration changes to Hostgroups and related objects.
- Monitor browser telemetry from administrator workstations for anomalous script execution or credential-related requests originating from the Centreon interface.
- Alert on creation or modification of Hostgroup objects by accounts outside the approved monitoring administration group.
How to Mitigate CVE-2025-54890
Immediate Actions Required
- Upgrade Centreon Web to a fixed release: 24.10.15, 24.04.19, or 23.10.29 or later, matching your deployed branch.
- Audit existing Hostgroup entries for suspicious content and sanitize or remove any that contain HTML or script fragments.
- Review and reduce the number of accounts holding elevated Centreon privileges required to reach the Hostgroup configuration page.
Patch Information
Centreon addressed the vulnerability in centreon_web versions 24.10.15, 24.04.19, and 23.10.29. Refer to the Centreon Release Notes and the Centreon Security Bulletin CVE-2025-54890 for upgrade instructions and version-specific guidance.
Workarounds
- Restrict access to Hostgroup configuration functions to a minimal set of trusted administrators until patching is complete.
- Instruct administrators to avoid navigating to Hostgroup configuration pages from accounts also used for privileged operations elsewhere.
- Apply a web application firewall rule to inspect and block requests to Hostgroup configuration endpoints that contain script tags or common XSS payload patterns.
# Example: verify installed Centreon Web version on a Linux host
rpm -q centreon-web || dpkg -l | grep centreon-web
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
