CVE-2023-35924
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform SQL injection attacks against GLPI's inventory endpoint. All GLPI installations running versions 10.0.0 through 10.0.7 are affected, and the endpoint requires no authentication by default.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution.
Likely Case
Unauthorized data access, data manipulation, and potential system compromise.
If Mitigated
Limited impact if proper network segmentation and authentication controls are in place.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit, and this requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.8
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-gxh4-j63w-8jmm
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download GLPI 10.0.8 from official sources. 3. Replace existing files with new version. 4. Run update script if needed. 5. Verify functionality.
🔧 Temporary Workarounds
Disable Native Inventory
allDisable the vulnerable inventory endpoint to prevent exploitation.
Edit GLPI configuration to disable inventory functionality
🧯 If You Can't Patch
- Implement strict network access controls to restrict access to GLPI inventory endpoint
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in administration panel or via version file.Check Version:
Check GLPI admin panel or view /glpi/inc/define.php for version constantVerify Fix Applied:
Confirm version is 10.0.8 or later and test inventory endpoint functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed inventory requests
- Suspicious patterns in web server access logs
Network Indicators:
- Unusual traffic to /front/inventory.php endpoint
- SQL injection patterns in HTTP requests
SIEM Query:
source="web_server" AND (uri="/front/inventory.php" OR uri="/glpi/front/inventory.php") AND (payload CONTAINS "UNION" OR payload CONTAINS "SELECT" OR payload CONTAINS "INSERT")