CVE-2024-43417

What it actually does

Reflected XSS in the Software form allows an unauthenticated attacker to inject and execute arbitrary scripts in a technician's browser session via a crafted URL parameter.

Why it matters to the business

Successful exploitation can result in theft of session tokens or sensitive IT asset data, enabling unauthorized access to the management platform and potential follow-on compromise of managed systems.

How an attack unfolds

An attacker crafts a malicious link containing a script payload targeting the Software form, delivers the link to a GLPI technician through email or chat, and relies on the technician clicking it while authenticated so the script executes in their browser context.

How to fix it

Upgrade glpi-project/glpi to 10.0.17 (commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9). Update tiff on Ubuntu 14.04 LTS to 4.0.3-7ubuntu0.6.

How to confirm the fix worked

Confirm installed GLPI version is 10.0.17 or newer via the About page or version file; re-test the Software form endpoint with known XSS vectors to ensure sanitization occurs.

Typical attack path

1. Identify the GLPI Software form endpoint
2. Craft URL with reflected XSS payload in query parameters
3. Deliver link to an authenticated technician
4. Technician opens the link in their browser
5. Malicious script executes and exfiltrates data or performs actions

How to detect it

Review web server access logs for requests to the Software form containing script tags, onerror handlers, or unusual encoded payloads; correlate with technician account activity for unexpected actions.

• /front/software.form.php?*script*
• /front/software.form.php?*<img*onerror*
• GLPI reflected XSS attempts with javascript: or data: URIs

What your security team should do

• Upgrade GLPI to the fixed version immediately due to public disclosure
• Implement input sanitization review for all form endpoints
• Train technicians to verify links before clicking
• Enable web application firewall rules blocking script tags in URLs