CVE-2024-45610

What it actually does

Reflected cross-site scripting flaw in the Cable form allows an attacker-supplied script to execute in the browser context of an authenticated technician when a crafted URL is visited.

Why it matters to the business

Successful exploitation can lead to theft of technician session tokens, unauthorized configuration changes, or further internal pivoting with minimal attacker effort.

How an attack unfolds

An unauthenticated attacker crafts a malicious link containing a script payload targeting the Cable form, delivers the link to a GLPI technician via email or chat, and the technician's click causes the payload to run in their authenticated session.

How to fix it

Upgrade glpi-project/glpi to version containing commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9 (10.0.17 or later). For neutron on Ubuntu 16.04 LTS apply package version 2:8.4.0-0ubuntu4 or newer. Restrict external link handling until patches are applied.

How to confirm the fix worked

Confirm the installed GLPI commit or version is at or above 08ee4d266768dc1f76cb6c716d7fd118d39676d9; test the Cable form with a benign script payload to verify reflection is blocked.

Typical attack path

1. Attacker identifies the Cable form endpoint and crafts a reflected XSS payload in a URL parameter.
2. Attacker sends the malicious link to a GLPI technician through phishing or other social channels.
3. Technician authenticates to GLPI and clicks the link, causing the browser to execute the injected script.
4. Script performs actions such as exfiltrating cookies, creating admin accounts, or modifying cable records.

How to detect it

Inspect web server access logs for requests to the Cable form endpoint containing script tags, event handlers, or encoded payloads; correlate with technician session activity and any subsequent administrative actions.

• cable.form.php? parameters containing <script
• cable.form.php? containing onerror=
• cable.form.php? containing javascript:

What your security team should do

• Immediately upgrade all GLPI instances to the fixed commit or 10.0.17 release.
• Monitor technician inboxes and chat channels for unexpected links referencing the Cable form.
• Enable web application firewall rules that sanitize reflected parameters in form endpoints.
• Review audit logs for any Cable form accesses containing script tags or unusual query strings.