CVE-2021-43778
📋 TL;DR
This CVE describes a path traversal vulnerability in the Barcode plugin for GLPI that allows attackers to read arbitrary files on the server. It affects GLPI instances version 2.x prior to 2.6.1 with the barcode plugin installed. The vulnerability is exploitable via the front/send.php file.
💻 Affected Systems
- GLPI Barcode Plugin
📦 What is this software?
Barcode by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files like configuration files, password files, or database credentials, potentially leading to full system compromise.
Likely Case
Unauthorized file disclosure including application configuration, user data, or system information.
If Mitigated
With proper file permissions and network segmentation, impact is limited to files accessible by the web server user.
🎯 Exploit Status
Public proof-of-concept exploits exist on GitHub. Exploitation requires sending specially crafted requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.1
Vendor Advisory: https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9
Restart Required: No
Instructions:
1. Update the barcode plugin to version 2.6.1 or later. 2. Download from GitHub releases. 3. Replace the plugin directory. 4. Clear GLPI cache if applicable.
🔧 Temporary Workarounds
Delete vulnerable file
linuxRemove the front/send.php file that contains the vulnerability
rm /path/to/glpi/plugins/barcode/front/send.php
Delete vulnerable file (Windows)
windowsRemove the front/send.php file that contains the vulnerability
del C:\path\to\glpi\plugins\barcode\front\send.php
🧯 If You Can't Patch
- Apply the workaround to delete front/send.php file
- Implement web application firewall rules to block path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check if plugins/barcode/front/send.php exists and plugin version is below 2.6.1Check Version:
Check GLPI plugin management interface or examine plugin files for version metadataVerify Fix Applied:
Verify plugins/barcode/front/send.php is removed or plugin version is 2.6.1+📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /plugins/barcode/front/send.php with ../ patterns
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests containing path traversal sequences (../) to barcode plugin endpoints
SIEM Query:
web.url:*barcode*front*send.php AND web.url:*..*🔗 References
- https://github.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20plugin
- https://github.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46
- https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1
- https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9
- https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43778
- https://github.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20plugin
- https://github.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46
- https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1
- https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9
