CVE-2024-45609

What it actually does

Reflected cross-site scripting flaw in GLPI reports pages allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of an authenticated technician who follows a crafted link.

Why it matters to the business

Successful exploitation can lead to theft of technician session tokens, unauthorized access to asset and service-desk data, or further internal compromise within organizations that rely on GLPI for IT asset and incident management.

How an attack unfolds

An attacker crafts a malicious URL containing a script payload targeting the reports pages, delivers the link via email or chat to a GLPI technician, and waits for the technician to click the link; the script then executes in the technician's authenticated session.

How to fix it

Upgrade GLPI to version 10.0.17 or apply commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9; remove or restrict access to the reports pages until patched.

How to confirm the fix worked

Confirm installed GLPI version is 10.0.17 or later; attempt to reproduce the reflected XSS with a benign payload on the reports pages and verify the payload is no longer executed.

Typical attack path

1. Identify GLPI reports endpoint and craft reflected XSS payload
2. Deliver malicious link to authenticated GLPI technician via phishing
3. Technician clicks link and browser executes attacker-controlled script
4. Script performs actions such as session hijacking or data exfiltration

How to detect it

Review web-server access logs for unusual query parameters on reports pages, inspect browser history or proxy logs for unexpected external links, and search authentication logs for sessions initiated from suspicious referrers.

What your security team should do

• Immediately upgrade all GLPI instances to 10.0.17
• Monitor technician accounts for anomalous activity until patches are applied
• Implement web-application firewall rules to block common reflected-XSS patterns on reports endpoints