CVE-2024-43418

What it actually does

The flaw permits an unauthenticated attacker to inject executable JavaScript into pages rendered for GLPI technicians by supplying a crafted URL whose parameters are reflected without adequate output encoding or sanitization.

Why it matters to the business

Successful exploitation can result in session hijacking or theft of sensitive asset-management data, allowing attackers to gain unauthorized visibility into or control over an organization's IT infrastructure and downstream systems.

How an attack unfolds

An attacker crafts a malicious link embedding a script payload and delivers it to a GLPI technician through phishing or similar channels; when the technician follows the link, the browser executes the script in the context of the authenticated GLPI session.

How to fix it

Upgrade glpi-project/glpi to version 10.0.17 (commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9). Apply the corresponding fixed packages for any affected Ubuntu Node.js distributions listed in the advisory.

How to confirm the fix worked

Confirm the installed GLPI version is 10.0.17 or later; retest affected endpoints to ensure reflected parameters are properly HTML-escaped and no script execution occurs.

Typical attack path

1. Identify a GLPI instance and locate a reflected input parameter
2. Craft a URL containing a malicious script payload in the reflected parameter
3. Deliver the URL to a GLPI technician via email, chat, or other messaging
4. Technician clicks the link, causing the script to execute in their browser

How to detect it

Inspect web server access logs for GET requests to GLPI paths containing script tags, javascript: URIs, or encoded payloads in query parameters; review browser or proxy logs for unexpected script execution originating from GLPI pages.

What your security team should do

• Immediately upgrade all GLPI instances to 10.0.17
• Implement URL filtering or email security controls to block suspicious links targeting GLPI
• Train technicians to verify link destinations before clicking
• Enable web application firewall rules that block common reflected XSS patterns