CVE-2018-11587

Vulnerability

A remote code execution vulnerability exists in Centreon 3.4.6 and Centreon Web 2.8.23. The flaw resides in the centreonGraph.class.php file, specifically in how the application handles the RPN (Reverse Polish Notation) value within the Virtual Metric form. An attacker can inject arbitrary commands via the RPN input, which is then passed unsanitized to the rrdtool command line [1][2][3]. The vulnerability affects the initCurveList method, where the RPN string is directly concatenated into the RRDtool CDEF argument [1].

Exploitation

An attacker must have authenticated access to the Centreon web interface with sufficient privileges to create or modify Virtual Metrics. No network-level access beyond the web UI is required. The attacker submits a malicious RPN expression (e.g., containing backticks or shell metacharacters) in the Virtual Metric form. This input is not sanitized and is passed to the rrdtool command line, allowing arbitrary command execution [1][3]. Proof-of-concept code was publicly disclosed shortly after the advisory [3].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands with the privileges of the web server process (typically www-data or apache). This can lead to full compromise of the Centreon server, including data exfiltration, lateral movement, and further attacks on the monitored infrastructure [2][4].

Mitigation

The vulnerability is fixed in Centreon Web version 2.8.24, released on June 25, 2018 [2][4]. The fix was implemented via pull request #6263, which sanitizes the RPN input before building the rrdtool command line [1][3]. Users should immediately upgrade to Centreon Web 2.8.24 or later. No workaround is available for unpatched versions. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last update.