CVE-2019-17501 - Centreon 19.04 Authenticated RCE

CVE-2019-17501.txt

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field
of main.php?p=60807&type=4 (aka the Configuration  >  Commands  >  Discovery screen).

------------------------------------------

[Additional Information]

Once one has logged into Centreon:
1. navigate to:  Configuration  >  Commands  >  Discovery OR http://ip-address/centreon/main.php?p=60807&type=4
2. in the "Command Line" section put a command: e.g. "cat /etc/passwd" without quotes. 
3. press the blue play icon under the "Command Line" section
4. a screen will appear and print the results of the given command in step 3

------------------------------------------

[Vulnerability Type]
Authentication Code Execution

------------------------------------------

[Vendor of Product]
Centreon

------------------------------------------

[Affected Product Code Base]
IT & Network Monitoring - 19.04

------------------------------------------

[Attack Type]
Remote

------------------------------------------

[Impact Code execution]
True

------------------------------------------

[Identified by]
sinfulz & payl0ad