CVE-2024-43416
📋 TL;DR
This vulnerability allows unauthenticated attackers to determine whether specific email addresses correspond to valid GLPI user accounts. It affects GLPI installations from version 0.80 through 10.0.16, enabling user enumeration attacks.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate all valid user accounts, enabling targeted phishing, credential stuffing, or brute force attacks against known valid accounts.
Likely Case
Attackers identify valid user accounts for reconnaissance purposes, increasing the success rate of subsequent attacks.
If Mitigated
Limited to user enumeration only - no password disclosure or account takeover directly from this vulnerability.
🎯 Exploit Status
Simple HTTP requests to the vulnerable endpoint can enumerate users without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.17
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-j8gc-xpgr-2ww7
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download GLPI 10.0.17 or newer from the official repository. 3. Follow the GLPI upgrade documentation to update your installation.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rule
allBlock requests to the vulnerable endpoint that perform user enumeration
Network Access Control
allRestrict access to GLPI to trusted IP addresses only
🧯 If You Can't Patch
- Implement rate limiting on the vulnerable endpoint to prevent mass enumeration
- Monitor logs for unusual patterns of requests to user-related endpoints
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated requests to the user enumeration endpoint return valid user informationCheck Version:
Check GLPI version in Administration > General > Information or via database queryVerify Fix Applied:
After patching, verify that unauthenticated requests no longer return user validation information📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from single IP
- Unusual patterns of requests to user validation endpoints
Network Indicators:
- HTTP requests to user enumeration endpoints without authentication headers
SIEM Query:
source="glpi_access.log" AND (uri_path="/path/to/vulnerable/endpoint" OR user_agent="*enumeration*" OR status_code=200 AND request_count>100)