CVE-2024-50339

What it actually does

Unauthenticated endpoint allows retrieval of all active session identifiers, enabling direct session hijacking without credentials.

Why it matters to the business

Attackers can impersonate any logged-in user and access sensitive IT asset and management data, risking data breaches and operational disruption in organizations using the software.

How an attack unfolds

An attacker issues an unauthenticated request to the exposed session listing functionality, obtains valid session IDs, and replays them to hijack authenticated user sessions and perform actions as those users.

How to fix it

Upgrade GLPI to version 10.0.17 or later; the fix is included in commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9.

How to confirm the fix worked

Confirm the installed version is 10.0.17 or newer; attempt an unauthenticated request to the session endpoint and verify that session IDs are no longer returned.

Typical attack path

1. Issue unauthenticated HTTP request to the vulnerable session enumeration endpoint
2. Parse response to collect all active session identifiers
3. Replay captured session tokens in subsequent requests to authenticated resources
4. Perform unauthorized actions or exfiltrate data while impersonating valid users

How to detect it

Inspect web server access logs for unauthenticated requests returning large numbers of session identifiers; look for session tokens being reused from multiple source IPs or unusual user-agent patterns after initial unauthenticated access.

What your security team should do

• Upgrade all GLPI instances to the fixed version immediately
• Review web access logs for prior unauthenticated requests to session endpoints
• Invalidate all active sessions after patching
• Monitor for anomalous session usage from unexpected locations or IPs