CVE-2024-45611

What it actually does

An authenticated user bypasses access controls to attach a private RSS feed containing a malicious payload to another user account, resulting in stored cross-site scripting execution when the feed is viewed.

Why it matters to the business

Attackers with valid credentials could execute scripts in other users' browsers within the IT asset management platform, enabling potential session hijacking, data exposure, or unauthorized actions in the service desk environment.

How an attack unfolds

An authenticated attacker identifies a way to create RSS feeds for other accounts, embeds a malicious script payload in the feed content, and waits for the victim to access the feed, triggering the stored XSS without further interaction.

How to fix it

Upgrade glpi-project/glpi to version 10.0.17 or apply commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9; review and remove any unauthorized RSS feeds created by non-administrative users.

How to confirm the fix worked

Verify the deployed GLPI version is 10.0.17 or newer; test RSS feed creation permissions to confirm only authorized users can attach feeds to other accounts; scan for residual malicious payloads in existing feeds.

Typical attack path

1. Obtain valid user credentials and authenticate
2. Craft and submit a request to create a private RSS feed assigned to a target user
3. Embed malicious JavaScript payload within the RSS feed data
4. Victim user views or loads the attached feed, executing the payload in their session context

How to detect it

Review application logs for RSS feed creation events where the creator differs from the target account owner; inspect stored RSS feed contents for script tags or unusual payloads; monitor for unexpected JavaScript execution in user sessions tied to feeds.

• rss feed creation request with mismatched user assignment
• script tags or javascript: in RSS feed content

What your security team should do

• Apply the GLPI upgrade to 10.0.17 without delay
• Audit existing RSS feeds and user permissions for unauthorized attachments
• Enable logging for RSS feed creation events and review for anomalies
• Consider additional input sanitization layers around feed rendering if upgrade timelines slip