CVE-2024-43416

What it actually does

Unauthenticated access to an application endpoint permits enumeration of valid user email addresses by confirming existence without authentication.

Why it matters to the business

Attackers can build lists of real user accounts to support targeted phishing, credential stuffing, or social engineering, increasing the chance of account compromise and further internal access.

How an attack unfolds

An attacker sends crafted requests to the exposed endpoint with guessed or harvested email addresses; the application responds differently for valid versus invalid addresses, allowing bulk enumeration of active users.

How to fix it

Upgrade GLPI to version 10.0.17 or later. The fix is present in commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9. Restrict public access to user-related endpoints until patched.

How to confirm the fix worked

Confirm the running version is 10.0.17 or newer. Test that the email validation endpoint now returns identical responses for both valid and invalid addresses when unauthenticated.

Typical attack path

1. Identify the GLPI instance and locate the unauthenticated email validation endpoint
2. Prepare a list of candidate email addresses from OSINT or domain harvesting
3. Issue repeated unauthenticated requests to the endpoint with each address
4. Parse responses to separate valid user accounts from invalid ones
5. Use the resulting list for follow-on attacks such as password spraying or phishing

How to detect it

Review web server access logs for repeated unauthenticated requests to the email validation endpoint with varying email parameters; look for high volumes of 200 responses mixed with differing content lengths that reveal user existence.

What your security team should do

• Apply the 10.0.17 update immediately on all internet-facing instances
• Add network or WAF rules to block unauthenticated access to the affected endpoint until patched
• Monitor authentication logs for spikes in failed logins using newly enumerated addresses
• Review and reduce the amount of user information exposed by public endpoints