SB2020052123 - OS Command Injection in Centreon

Description

This security bulletin contains information about 1 security vulnerability.

1) OS Command Injection (CVE-ID: CVE-2020-13252)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote authenticated attacker can send a specially crafted "main.get.php" request, place shell metacharacters in "RRDdatabase_status_path", then visit the "include/views/graphs/graphStatus/displayServiceStatus.php" and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://engindemirbilek.github.io/centreon-19.10-rce
• https://github.com/centreon/centreon/compare/19.04.13...19.04.15
• https://github.com/centreon/centreon/pull/8467
• https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.html