Centreon 19.10.5 - Database Credentials Disclosure

vendor:

Centreon

by:

Fabien AUNAY, Omri Baso

8.8

CVSS

HIGH

Database Credentials Disclosure

522

CWE

Product Name: Centreon

Affected Version From: 19.10.5

Affected Version To: 19.10.5

Patch Exists: NO

Related CWE: -

CPE: centreon

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: CentOS 7

2020

Centreon 19.10.5 – Database Credentials Disclosure

It is possible to discover the unencrypted password with the inspector.

Mitigation:

Ensure that the database credentials are encrypted and not exposed in plain text.

Source

Exploit-DB raw data:

# Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure
# Date: 2020-01-27
# Exploit Author: Fabien AUNAY, Omri Baso
# Vendor Homepage: https://www.centreon.com/
# Software Link: https://github.com/centreon/centreon
# Version: 19.10.5
# Tested on: CentOS 7
# CVE : -

###########################################################################################################
Centreon 19.10.5 Database Credentials Disclosure

Trusted by SMBs and Fortune 500 companies worldwide.
An industry reference in IT Infrastructure monitoring for the enterprise.
Counts 200,000+ ITOM users worldwide and an international community of software collaborators.
Presence in Toronto and Luxembourg.
Deployed in diverse sectors:
- IT & telecommunication
- Transportation
- Government
- Heath care
- Retail
- Utilities
- Finance & Insurance
- Aerospace & Defense
- Manufacturing
- etc.

###########################################################################################################

POC:

- Configuration / Pollers / Broker configuration
-- Central-broker | Central-broker-master
--- Output

It is possible to discover the unencrypted password with the inspector.


DB user        centreon
DB password    ********
<input size="120" name="output[0][db_password]" type="password" value="ZVy892xx">