CVE-2023-28632
📋 TL;DR
This vulnerability allows authenticated GLPI users to modify any user's email address, enabling account takeover through password reset functionality and potential exposure of sensitive notification data. It affects GLPI installations from version 0.83 up to but excluding versions 9.5.13 and 10.0.7.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of any user account including administrators, leading to full system control, data theft, and privilege escalation across the GLPI instance.
Likely Case
Unauthorized email modification leading to account takeover of regular users, exposure of sensitive notifications, and potential lateral movement within the system.
If Mitigated
Limited to unauthorized email modification without account takeover if password reset notifications are disabled, but still allows email spoofing and potential data exposure.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.5.13 or 10.0.7
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x
Restart Required: No
Instructions:
1. Backup your GLPI database and files. 2. Download the patched version (9.5.13 or 10.0.7) from the official GLPI repository. 3. Follow the GLPI upgrade documentation for your version. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable Password Reset Notifications
allPrevents account takeover by disabling email notifications for password reset events, but does not prevent unauthorized email modification.
Navigate to GLPI Setup > Notifications > Event > 'Forgotten password?' and disable all notification methods
🧯 If You Can't Patch
- Implement strict access controls and monitor user email modification activities
- Disable password reset functionality entirely and require manual password resets by administrators
🔍 How to Verify
Check if Vulnerable:
Check GLPI version via the web interface (Setup > About) or by examining the GLPI installation files. If version is between 0.83-9.5.12 or 10.0.0-10.0.6, the system is vulnerable.Check Version:
Check the GLPI web interface at /front/central.php or examine the GLPI files for version informationVerify Fix Applied:
After patching, verify the version shows 9.5.13 or 10.0.7. Test that authenticated users cannot modify other users' email addresses.📡 Detection & Monitoring
Log Indicators:
- Multiple email modification events from single user accounts
- Unusual password reset requests
- User profile modification logs showing email changes
Network Indicators:
- HTTP POST requests to user profile update endpoints from unauthorized sources
SIEM Query:
source="glpi_logs" AND (event="user_email_change" OR event="password_reset_request") | stats count by user, target_user🔗 References
- https://github.com/glpi-project/glpi/releases/tag/10.0.7
- https://github.com/glpi-project/glpi/releases/tag/9.5.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x
- https://github.com/glpi-project/glpi/releases/tag/10.0.7
- https://github.com/glpi-project/glpi/releases/tag/9.5.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x
