CVE-2024-23116

What it actually does

The vulnerability is an authenticated SQL injection in Centreon’s updateLCARelation function. A user-supplied string is incorporated into SQL queries without sufficient validation or parameterization, allowing a privileged authenticated attacker to alter query logic. Because the vulnerable path can be abused beyond data access, successful exploitation can lead to arbitrary code execution in the context of the Centreon service account, with potential compromise of monitoring data, credentials accessible to the application, configuration state, and the underlying host privileges available to that service.

Why it matters to the business

Centreon is commonly used to monitor infrastructure and services, so compromise can give an attacker visibility into critical systems, credentials, host inventories, alerting workflows, and operational dependencies. An attacker with sufficient Centreon access could tamper with monitoring, hide outages or malicious activity, pivot toward monitored assets, or disrupt business operations. Although exploitation requires authentication with high privileges and the issue is not currently listed in CISA KEV, the EPSS score is elevated, the vulnerability has been public for a long period, and exposed or weakly governed Centreon administrator access should be treated as a priority risk.

How an attack unfolds

An attacker first obtains or abuses a privileged Centreon account, such as through credential theft, password reuse, session compromise, or insider access. The attacker then reaches the Centreon web interface or API path that invokes updateLCARelation and submits crafted input in a parameter used by that function. Because the input is not safely validated before being embedded in SQL, the database executes attacker-influenced SQL. Depending on database permissions, Centreon deployment configuration, and available application functionality, the attacker can use this to read or modify application data and escalate the SQL injection into command execution under the Centreon service account. After execution, the attacker may deploy web-accessible files, run shell commands, collect secrets, alter monitoring configuration, suppress alerts, or use the monitoring server as a pivot point into other infrastructure.

How to fix it

Upgrade Centreon to a version that includes the upstream fix for updateLCARelation. For source-based deployments, ensure the codebase contains commit b0c74f195b1b48c7af9ec168db3cfbcade99da7f or a later release that incorporates it. If immediate upgrade is not possible, restrict access to the Centreon web interface to trusted administrative networks, enforce MFA for privileged users, review and reduce Centreon administrative privileges, disable unused privileged accounts, rotate credentials that may be stored or accessible through Centreon, and monitor for suspicious SQL errors or command execution from the web/service account. Because exploitation requires privileged authentication, hardening identity controls and session security materially reduces exposure but should not be considered a substitute for patching.

How to confirm the fix worked

Confirm the installed Centreon version or source revision includes commit b0c74f195b1b48c7af9ec168db3cfbcade99da7f or a vendor release containing that fix. Review the patched source to verify updateLCARelation no longer concatenates untrusted input directly into SQL and uses safe validation or parameterized query handling. From an exposure perspective, confirm Centreon administrative interfaces are not publicly reachable unless explicitly required, privileged accounts are limited, and MFA is enforced where supported. Validate that application, web server, database, and system logs are being retained and that alerts exist for SQL errors, suspicious updateLCARelation activity, and child shell/process execution by the Centreon web or service account.

Typical attack path

1. Obtain valid privileged Centreon credentials or hijack a privileged session.
2. Access the Centreon management interface reachable over the network.
3. Identify the request path or workflow that triggers updateLCARelation.
4. Submit malicious SQL content in the affected user-controlled field.
5. Use the SQL injection to enumerate or manipulate Centreon database content.
6. Escalate the database manipulation into arbitrary code execution where deployment permissions allow it.
7. Run commands as the Centreon service account or web application user.
8. Harvest credentials, alter monitoring configuration, disable or suppress alerts, and pivot to monitored systems.

How to detect it

Investigate whether privileged Centreon accounts accessed the updateLCARelation workflow with unusual parameters, especially from unfamiliar IP addresses, at unusual times, or shortly before database errors or process execution on the Centreon host. Review web access logs, Centreon application logs, PHP logs, database logs, authentication/session logs, sudo/audit logs, EDR telemetry, and shell history for the Centreon service account or web server user. Look for SQL injection syntax in HTTP parameters, repeated application errors near updateLCARelation activity, MySQL/MariaDB error messages, attempts to write files through database functions, and web/service account processes spawning shells, interpreters, download utilities, or network tools. Also compare Centreon configuration, users, notification settings, plugins, poller commands, and monitoring checks against known-good baselines, because an attacker may modify monitoring behavior to suppress alerts or establish persistence.

• updateLCARelation
• UNION SELECT
• UNION ALL SELECT
• INTO OUTFILE
• INTO DUMPFILE
• LOAD_FILE(
• SLEEP(
• BENCHMARK(
• information_schema
• mysql.user
• SQL syntax
• You have an error in your SQL syntax
• mysqli_sql_exception
• PDOException
• /var/log/centreon/centreon.log
• /var/log/centreon/sql-error.log
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /usr/share/centreon
• /etc/centreon
• /var/lib/centreon
• /var/cache/centreon
• /var/log/centreon
• bash -c
• sh -c
• /bin/bash
• /bin/sh
• curl
• wget
• nc
• ncat
• python -c
• python3 -c
• php -r
• perl -e
• socat

What your security team should do

• Patch or upgrade Centreon to a build containing commit b0c74f195b1b48c7af9ec168db3cfbcade99da7f as the primary remediation.
• Prioritize systems with internet-facing Centreon access, broad administrative user populations, weak MFA coverage, or access to sensitive monitored infrastructure.
• Audit Centreon privileged accounts, remove stale administrators, enforce MFA, and rotate passwords or API tokens for accounts with elevated access.
• Restrict Centreon management access using VPN, allowlists, bastion hosts, or other administrative access controls.
• Hunt historical logs for suspicious updateLCARelation requests, SQL injection patterns, database errors, and operating system commands spawned by web or Centreon service users.
• Review Centreon configuration, notification rules, monitoring checks, plugins, and scheduled tasks for unauthorized changes.
• Rotate secrets stored in or accessible by Centreon if exploitation is suspected, including monitoring credentials, SNMP communities, API keys, database credentials, and service account passwords.
• Ensure EDR or system audit logging covers the Centreon host and alerts on web/service account execution of shells, download utilities, interpreters, and network tooling.