CVE-2021-43779
📋 TL;DR
CVE-2021-43779 is an authenticated remote code execution vulnerability in the GLPI addressing plugin that allows attackers with valid credentials to execute arbitrary commands on the underlying operating system. This affects GLPI users who have the addressing plugin enabled. The vulnerability stems from improper input validation (CWE-20) in plugin versions before 2.9.1.
💻 Affected Systems
- GLPI addressing plugin
📦 What is this software?
Addressing by Teclib Edition
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the GLPI server with attacker gaining root/system-level access, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Unauthorized access to sensitive IT asset data, service desk information, and potential ransomware deployment on the affected server.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and command execution restrictions are in place.
🎯 Exploit Status
Multiple public exploit scripts exist. Attack requires valid GLPI user credentials but no special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.1
Vendor Advisory: https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Update the addressing plugin to version 2.9.1 or later via GLPI's plugin management interface or manual installation. 3. Verify the plugin version shows 2.9.1 or higher.
🔧 Temporary Workarounds
Disable addressing plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to GLPI admin interface > Plugins > Addressing > Click disable
🧯 If You Can't Patch
- Disable the addressing plugin immediately
- Implement strict network segmentation to isolate the GLPI server and restrict access to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check GLPI admin interface > Plugins > Addressing. If version is below 2.9.1 and plugin is enabled, system is vulnerable.Check Version:
Check GLPI web interface or examine plugin files: cat /var/www/html/glpi/plugins/addressing/inc/common.class.php | grep 'plugin_version'Verify Fix Applied:
Verify addressing plugin version shows 2.9.1 or higher in GLPI plugin management.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- GLPI logs showing unexpected addressing plugin activity
- Web server logs with suspicious POST requests to addressing plugin endpoints
Network Indicators:
- Outbound connections from GLPI server to unexpected destinations
- Command and control traffic patterns
SIEM Query:
source="glpi_logs" AND ("addressing" AND ("exec" OR "system" OR "shell_exec" OR "passthru"))🔗 References
- https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin
- https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366
- https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh
- https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779
- https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin
- https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366
- https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh
