CVE-2024-41678

What it actually does

Reflected cross-site scripting flaw that executes attacker-supplied JavaScript in the browser of an authenticated GLPI technician when the technician follows a crafted URL supplied by an unauthenticated user.

Why it matters to the business

Successful exploitation can result in session hijacking, unauthorized disclosure or modification of asset and IT management data, and potential lateral movement within the organization's infrastructure; the issue affects all organizations running GLPI before version 10.0.17 and carries moderate urgency given its public disclosure and stable low exploitation probability.

How an attack unfolds

An attacker crafts a malicious URL containing a reflected XSS payload, delivers the link to a GLPI technician via email or another channel, and relies on the technician clicking the link; the payload then executes in the technician's browser context with no authentication required from the attacker.

How to fix it

Upgrade GLPI to version 10.0.17 or later; apply the fix from commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9 on GIT installations; verify that all instances are updated and test the application after deployment.

How to confirm the fix worked

Confirm the installed GLPI version is 10.0.17 or newer; attempt to reproduce the reflected XSS with a benign payload and verify it is sanitized; review release notes and changelog for the fix.

Typical attack path

1. Identify a GLPI instance and a target technician email address
2. Craft a URL that reflects a JavaScript payload through an unauthenticated parameter
3. Deliver the link to the technician through phishing or other social engineering
4. Technician authenticates and clicks the link, causing the payload to execute
5. Payload performs actions such as cookie theft, form submission, or redirection

How to detect it

Inspect web server access logs for requests containing suspicious script tags or event handlers in query parameters to GLPI unauthenticated endpoints; correlate with technician session activity for unexpected actions or redirects.

What your security team should do

• Prioritize upgrade of all GLPI instances to 10.0.17 within the next maintenance window
• Educate technicians on verifying links before clicking and on recognizing suspicious GLPI URLs
• Monitor web application firewall rules for reflected XSS patterns targeting GLPI endpoints
• Review user activity logs for any anomalous actions performed by technician accounts