CVE-2024-11955
📋 TL;DR
This CVE describes an open redirect vulnerability in GLPI versions up to 10.0.17. Attackers can manipulate the 'redirect' parameter in /index.php to redirect users to malicious websites. All GLPI installations up to version 10.0.17 are affected.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially leading to account compromise or system infection.
Likely Case
Attackers use the redirect for phishing campaigns, tricking users into visiting malicious sites that appear legitimate.
If Mitigated
With proper user awareness training and browser security settings, users might recognize suspicious redirects before providing sensitive information.
🎯 Exploit Status
Exploit details are publicly available and require minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.18
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-g5fm-jq4j-c2c7
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download GLPI 10.0.18 from the official releases page. 3. Replace the existing GLPI files with the new version. 4. Run the update script if prompted. 5. Verify the installation is working correctly.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to restrict redirect URLs to trusted domains only.
Web Application Firewall Rule
allConfigure WAF to block requests containing external URLs in the redirect parameter.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to restrict redirect destinations
- Monitor web server logs for suspicious redirect parameter patterns
🔍 How to Verify
Check if Vulnerable:
Check your GLPI version by logging into the admin panel and viewing the version information, or check the GLPI configuration files.Check Version:
Check the GLPI admin dashboard or examine the inc/config.php file for version information.Verify Fix Applied:
After upgrading to 10.0.18, test the redirect functionality with external URLs to confirm they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /index.php with redirect parameter containing external domains
- Unusual redirect patterns in access logs
Network Indicators:
- Outbound connections to unexpected domains following GLPI access
SIEM Query:
source="web_server" AND uri="/index.php" AND query="*redirect=*" AND NOT query="*redirect=internal*"