CVE-2024-45611
📋 TL;DR
This vulnerability allows authenticated GLPI users to bypass access controls and create private RSS feeds attached to other user accounts. Attackers can inject malicious JavaScript payloads that trigger stored cross-site scripting (XSS) attacks when victims view the compromised feeds. All GLPI instances running vulnerable versions are affected.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal session cookies, perform actions as other users, escalate privileges, or deploy malware to victim browsers.
Likely Case
Attackers will steal authenticated sessions to gain unauthorized access to sensitive IT asset data or perform limited administrative actions.
If Mitigated
With proper input validation and output encoding, the XSS payload would be neutralized, limiting impact to access control bypass only.
🎯 Exploit Status
Exploitation requires authenticated access but uses simple XSS payloads with access control bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.17
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-j73h-x6j3-m479
Restart Required: No
Instructions:
1. Backup your GLPI database and files. 2. Download GLPI 10.0.17 from official sources. 3. Follow the GLPI upgrade documentation. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable RSS Feed Functionality
allTemporarily disable RSS feed creation to prevent exploitation while planning upgrade.
Implement WAF Rules
allDeploy web application firewall rules to block XSS payloads in RSS feed parameters.
🧯 If You Can't Patch
- Restrict user permissions to minimize authenticated users who could exploit this vulnerability.
- Implement Content Security Policy (CSP) headers to mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in Administration > General > Information, or examine the GLPI source code for version markers.Check Version:
php -r "include('config/config_db.php'); echo 'GLPI version: ' . GLPI_VERSION;"Verify Fix Applied:
Confirm version is 10.0.17 or later and test RSS feed creation with XSS payloads to ensure they're sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual RSS feed creation events
- JavaScript payloads in GLPI logs
- Multiple failed access attempts to other user accounts
Network Indicators:
- Suspicious POST requests to RSS feed endpoints with script tags
- Unexpected outbound connections from GLPI server
SIEM Query:
source='glpi_logs' AND (event='rss_feed_creation' OR message LIKE '%<script%')