CVE-2024-37149
📋 TL;DR
Authenticated technician users in GLPI can upload malicious PHP scripts and hijack the plugin loader to execute arbitrary code. This affects GLPI installations with technician user accounts that have upload privileges.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, lateral movement, and complete system control.
Likely Case
Unauthorized code execution within the GLPI application context, potentially accessing sensitive IT asset data.
If Mitigated
Limited impact if proper file upload restrictions and user privilege controls are implemented.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.16
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-cwvp-j887-m4xh
Restart Required: No
Instructions:
1. Backup your GLPI database and files. 2. Download GLPI 10.0.16 or newer. 3. Follow the official GLPI upgrade procedure. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict file uploads
allLimit file upload capabilities for technician users to prevent malicious PHP uploads.
Implement WAF rules
allAdd web application firewall rules to block PHP file uploads and suspicious plugin loader requests.
🧯 If You Can't Patch
- Implement strict user access controls and limit technician privileges
- Monitor file upload directories for PHP files and implement real-time alerting
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in administration panel or via 'php glpi/console version' command.Check Version:
php glpi/console versionVerify Fix Applied:
Confirm version is 10.0.16 or higher and test that PHP file uploads are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to GLPI directories
- PHP file execution in plugin directories
- Multiple failed upload attempts
Network Indicators:
- HTTP POST requests with PHP file uploads to GLPI endpoints
- Unusual outbound connections from GLPI server
SIEM Query:
source="glpi.log" AND ("upload" OR "plugin") AND ("php" OR "exec")