CVE-2024-40638
📋 TL;DR
This SQL injection vulnerability in GLPI allows authenticated users to execute arbitrary SQL queries. An attacker could modify other user accounts to gain unauthorized access. All GLPI instances with vulnerable versions are affected.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GLPI instance, data exfiltration, privilege escalation to administrator, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to other user accounts, data manipulation, and privilege escalation within the GLPI application.
If Mitigated
Limited impact if strong authentication controls, network segmentation, and database permissions restrict SQL execution.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized; authenticated access lowers barrier but exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.17
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-8843-r3m7-gfqx
Restart Required: No
Instructions:
1. Backup your GLPI database and files. 2. Download GLPI 10.0.17 from the official repository. 3. Follow the GLPI upgrade documentation to apply the update. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict User Permissions
allLimit authenticated users to minimal necessary permissions to reduce attack surface.
Network Segmentation
allIsolate GLPI server from sensitive networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Monitor for suspicious SQL queries in database logs
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in administration interface or via 'php glpi/console.php version' command.Check Version:
php glpi/console.php versionVerify Fix Applied:
Confirm version is 10.0.17 or higher using the same version check method.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by account modifications
Network Indicators:
- SQL injection patterns in HTTP requests to GLPI endpoints
SIEM Query:
source="glpi_access.log" AND (url="*sql*" OR method="POST" AND uri="*/ajax/*")