Server-Side Template Injection in Centreon Open-Tickets Module

Executive Summary

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that allows Remote Code Execution.

The issue arises because the message_confirm field is stored without sanitization and rendered via the Smarty template engine with no security policy enabled.

As a result, any authenticated user can inject and execute arbitrary code on the server.

Useful 0 Not Useful 0

Detection Guidance

To detect the CVE-2026-14453 vulnerability on your network or system, you can follow these steps:

• Check if the centreon-open-tickets module is installed and its version. The vulnerability affects Centreon installations with this module enabled.
• Inspect the Centreon web interface for the presence of the message_confirm field in forms or templates, particularly in the centreon-open-tickets module. Unsantized input in this field is a key indicator of the vulnerability.
• Use network scanning tools to identify Centreon instances in your environment. For example, you can use Nmap to scan for Centreon web ports (typically 80 or 443) with commands like: nmap -p 80,443 --open <network_range>.
• Verify the Smarty template engine configuration in Centreon. The vulnerability arises from Smarty being used without a security policy. Check for the absence of security policies in Smarty configurations related to the centreon-open-tickets module.
• Test for the vulnerability by attempting to inject simple Smarty template syntax (e.g., {php}echo 'test';{/php}) into the message_confirm field. If the server executes the code or returns an error indicating template processing, the system may be vulnerable. Note: Only perform this test in a controlled environment with proper authorization.

Additionally, monitor Centreon logs for unusual activity, such as unexpected template rendering errors or suspicious input in the message_confirm field.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to disclosure of environment secrets, which may expose sensitive information.

It can also impact the availability of the Centreon Infra Monitoring platform by allowing attackers to execute arbitrary code remotely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows remote code execution through a Server-Side Template Injection in Centreon's centreon-open-tickets module, leading to disclosure of environment secrets and potential impact on platform availability.

Such unauthorized disclosure of sensitive information and disruption of service could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system availability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that allows remote code execution via the unsanitized message_confirm field.

Immediate mitigation steps include updating Centreon to a version where this vulnerability is fixed. Check the official Centreon GitHub releases page for patches or updated versions that address this issue.

Additionally, restrict authenticated user permissions to minimize the risk of exploitation until a patch is applied.

Useful 0 Not Useful 0