CVE-2024-47759

What it actually does

Stored cross-site scripting flaw allows a technician to upload an SVG file containing executable script that runs in the browser of any user who views the document.

Why it matters to the business

Attackers can hijack user sessions, steal sensitive data, or perform actions on behalf of legitimate users inside the asset management system, potentially leading to data breaches or unauthorized changes.

How an attack unfolds

An authenticated technician crafts a malicious SVG file with embedded script and uploads it as a document. When any user later opens or previews that document, the script executes in their browser context.

How to fix it

Upgrade glpi-project/glpi to the version containing commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9 (equivalent to 10.0.17). Sanitize or block SVG uploads until the fix is applied.

How to confirm the fix worked

Confirm the installed commit or version is at or beyond 08ee4d266768dc1f76cb6c716d7fd118d39676d9. Test by attempting to upload and view an SVG containing a harmless script and verifying it no longer executes.

Typical attack path

1. Obtain a low-privileged technician account
2. Upload a crafted SVG document containing malicious script
3. Wait for or lure other users to view the document
4. Script executes to perform actions such as session hijacking or data exfiltration

How to detect it

Search document upload and view logs for SVG file extensions, inspect uploaded files for script or event-handler tags, and review browser console or proxy logs for unexpected script execution originating from document preview endpoints.

• SVG files containing <script>, onload, or onerror attributes
• Document view requests that return content-type image/svg+xml with embedded executable code

What your security team should do

• Apply the fixed commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9 immediately
• Review recent document uploads for SVG files and inspect their contents
• Restrict SVG upload permissions to trusted roles until patching is complete
• Monitor for unusual script execution or unexpected user actions in audit logs