CVE-2023-34254
📋 TL;DR
CVE-2023-34254 is a command injection vulnerability in GLPI Agent that allows authenticated remote administrators to execute arbitrary commands on Unix systems where the agent runs with elevated privileges. This could lead to full system compromise and disclosure of remote access credentials. Systems running GLPI Agent versions before 1.5 with remoteinventory tasks against Unix platforms are affected.
💻 Affected Systems
- GLPI Agent
📦 What is this software?
Glpi Agent by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing complete control over the host, credential theft, and lateral movement within the network.
Likely Case
Privilege escalation to root/admin level on the agent host, enabling installation of backdoors, data exfiltration, and persistence mechanisms.
If Mitigated
Limited impact if agent runs with minimal privileges and proper network segmentation prevents lateral movement.
🎯 Exploit Status
Exploitation requires authenticated administrator access to the remote Unix system. The command injection occurs in a specific workflow when processing SSH commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5
Vendor Advisory: https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-39vc-hxgm-j465
Restart Required: Yes
Instructions:
1. Stop all glpi-agent services. 2. Backup configuration files. 3. Upgrade to glpi-agent version 1.5 or later using your package manager or from source. 4. Restart glpi-agent services. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable remoteinventory tasks
linuxTemporarily disable remoteinventory tasks to prevent exploitation while planning upgrade.
Edit glpi-agent configuration to remove or comment out remoteinventory tasks
Restart glpi-agent service
Run agent with reduced privileges
linuxConfigure glpi-agent to run with non-administrative privileges to limit impact.
Create dedicated low-privilege user for glpi-agent
Modify service configuration to run as non-root user
Set appropriate file permissions
🧯 If You Can't Patch
- Implement strict access controls to limit who can access Unix systems where glpi-agent runs remoteinventory tasks.
- Deploy network segmentation to isolate systems running vulnerable glpi-agent versions from critical infrastructure.
🔍 How to Verify
Check if Vulnerable:
Check glpi-agent version: 'glpi-agent --version' or 'rpm -q glpi-agent' or 'dpkg -l glpi-agent'. If version is below 1.5 and remoteinventory tasks are configured, system is vulnerable.Check Version:
glpi-agent --versionVerify Fix Applied:
Verify glpi-agent version is 1.5 or higher: 'glpi-agent --version'. Check that remoteinventory tasks still function properly after upgrade.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in glpi-agent logs
- SSH connection attempts from glpi-agent to unexpected hosts
- Process execution with unexpected arguments in system logs
Network Indicators:
- Unexpected outbound connections from glpi-agent hosts
- SSH traffic patterns inconsistent with normal inventory operations
SIEM Query:
source="glpi-agent" AND (event="command_execution" OR event="remote_inventory") AND command="*;*" OR command="*|*" OR command="*`*"🔗 References
- https://github.com/glpi-project/glpi-agent/blob/dd313ee0914becf74c0e48cb512765210043b478/Changes#L98
- https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-39vc-hxgm-j465
- https://github.com/glpi-project/glpi-agent/blob/dd313ee0914becf74c0e48cb512765210043b478/Changes#L98
- https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-39vc-hxgm-j465
