CVE-2024-38370

What it actually does

Missing authorization check on document download endpoints in the REST API permits retrieval of files without verifying user permissions or session context.

Why it matters to the business

Sensitive internal documents and asset records can be accessed by unauthorized parties, increasing risk of data exposure and compliance violations until the software is updated.

How an attack unfolds

An attacker identifies the GLPI API document endpoint, crafts a direct request supplying only a document identifier, and receives the file contents because the server performs no permission validation before serving the attachment.

How to fix it

Upgrade all GLPI instances to version 10.0.16 or later; apply commit 683393a84eeff1e165fa0f9f31067cc9add09b70 on any custom GIT-based deployments and restart web services.

How to confirm the fix worked

Confirm the installed version is 10.0.16 or newer, then attempt document downloads with a low-privilege account and verify that previously accessible files now return 403 or require proper authorization headers.

Typical attack path

1. Discover public or semi-public GLPI instance and enumerate API routes
2. Obtain or guess a valid document ID from error messages or prior reconnaissance
3. Issue unauthenticated or low-privilege GET request to the document download endpoint
4. Receive and exfiltrate the file contents

How to detect it

Inspect web server and application logs for repeated or anomalous requests to document download API paths from unexpected source IPs or without corresponding authentication events; correlate with file access timestamps.

What your security team should do

• Prioritize upgrade of all internet-facing GLPI deployments within the next maintenance window
• Review API access logs for unexpected document retrievals since publication date
• Restrict direct API exposure behind authentication proxies until patches are applied
• Update inventory and ticketing workflows to avoid reliance on the affected document endpoints