CVE-2022-24867
📋 TL;DR
CVE-2022-24867 is an information disclosure vulnerability in GLPI where the LDAP password is exposed in rendered page source code due to insufficient filtering of configuration variables passed to JavaScript. This affects all GLPI instances using LDAP authentication, potentially exposing sensitive directory service credentials to anyone who can view page source.
💻 Affected Systems
- GLPI (Gestionnaire Libre de Parc Informatique)
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain LDAP directory service credentials, potentially gaining full access to directory services, compromising all user accounts, and enabling lateral movement across the network.
Likely Case
Unauthorized users access LDAP credentials, potentially compromising the LDAP directory and enabling privilege escalation or data exfiltration.
If Mitigated
With proper network segmentation and access controls, impact is limited to credential exposure requiring rotation and potential LDAP service compromise.
🎯 Exploit Status
Exploitation requires viewing page source code, which typically requires at least some level of access to the GLPI interface. The advisory confirms the vulnerability is easily exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.2 and later
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download GLPI 10.0.2 or later from the official repository. 3. Replace existing files with new version. 4. Run the update script via web interface or command line. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable LDAP Authentication
allTemporarily disable LDAP authentication until patching is complete
Edit GLPI configuration to remove LDAP settings or switch to local authentication
🧯 If You Can't Patch
- Disable LDAP authentication immediately and rotate all exposed LDAP credentials
- Implement strict access controls to limit who can view GLPI pages and inspect page source
🔍 How to Verify
Check if Vulnerable:
1. Log into GLPI with LDAP authentication enabled. 2. View page source (Ctrl+U in browser). 3. Search for 'ldap_pass' in the source code. If found with password value, system is vulnerable.Check Version:
Check GLPI version via web interface (Setup > General > Information) or in config/glpicrypt.key fileVerify Fix Applied:
1. After patching, repeat the vulnerable check. 2. 'ldap_pass' should no longer appear in page source or should be properly filtered/obfuscated. 3. Verify GLPI version is 10.0.2 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual LDAP authentication attempts from unexpected sources
- Multiple failed login attempts followed by successful LDAP authentication
Network Indicators:
- Unexpected LDAP queries from GLPI server to directory services
- Traffic patterns suggesting credential harvesting
SIEM Query:
source="glpi" AND ("ldap_pass" OR "password exposure" OR "credential leak")🔗 References
- https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e
- https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr
- https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e
- https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr
