CVE-2024-37149

What it actually does

Authenticated technician users can upload a malicious PHP file and abuse the plugin loader mechanism to achieve arbitrary code execution on the server.

Why it matters to the business

Successful exploitation grants attackers full control over an organization's IT asset and service management platform, enabling theft or alteration of sensitive inventory, license, and operational data along with potential lateral movement into connected systems.

How an attack unfolds

An attacker with technician credentials uploads a crafted PHP script through normal file upload features, then manipulates the plugin loading logic so the malicious script is included and executed during normal operation, resulting in remote code execution.

How to fix it

Upgrade GLPI to version 10.0.16 or later; for Git installations apply commit 683393a84eeff1e165fa0f9f31067cc9add09b70. Restrict technician plugin upload privileges until the update is applied and monitor for unauthorized file uploads in plugin directories.

How to confirm the fix worked

Verify the installed GLPI version is 10.0.16 or newer, confirm the presence of the fix commit in Git-based deployments, and test that plugin uploads are properly sanitized and cannot execute arbitrary code.

Typical attack path

1. Obtain or compromise credentials for a technician-level account
2. Authenticate to the GLPI web interface
3. Upload a malicious PHP payload disguised as a plugin component
4. Trigger the plugin loader to include and execute the uploaded script
5. Execute arbitrary commands on the underlying server

How to detect it

Search web server and application logs for unexpected file uploads to plugin directories, followed by execution of non-standard PHP files; look for new or modified files in plugin folders with timestamps after the last legitimate update.

What your security team should do

• Apply the 10.0.16 update or equivalent Git commit immediately given the stable EPSS score above 0.2
• Audit and reduce the number of users with technician upload rights
• Enable web application firewall rules to block suspicious PHP uploads in plugin paths
• Review server logs for unexpected .php files in plugin directories