The GLPI software is widely used in IT service management for asset management and service desk functionalities. Organizations, from small businesses to large enterprises, often implement GLPI to manage their IT infrastructure efficiently. It provides tools for managing IT assets, licenses, and tracking the incidents. GLPI's functionalities are utilized by IT departments to streamline their operations and provide better service to their users. The software supports plugin extensions, allowing customization for specific needs. Overall, GLPI aims to enhance organizational productivity by offering an efficient system for managing IT resources and support services.
The vulnerability found in GLPI involves a blind SQL injection in the history log filter. SQL injection vulnerabilities allow attackers to interfere with the queries an application makes to its database. The identified issue occurs because of improper handling of input filters that manipulate database queries related to the history log. An attacker can manipulate these filters to execute arbitrary SQL code, even allowing unauthorized viewing, modification, or altering of data. Blind SQL injection refers to achieving this without directly revealing data, often through altering conditions to observe application behavior or delay. This vulnerability affects GLPI versions before 10.0.26 and 11.0.8.
Technical analysis reveals that the endpoint affected by the vulnerability is the history log filter within the Log::convertFiltersValuesToSqlCriteria() function. This function improperly processes user input by splitting it into key:operator:value parts. Within this setting, significant operators such as OR, AND, and NOT are not correctly handled as column names due to the lack of quoting, thereby allowing SQL injection through this vector. Specifically, placing payloads like "OR::1 AND sleep(5)" influences backend query processing, indicating a successful injection by delaying server responses. The exploitation requires an authenticated user with access to logs READ permissions.
If this SQL injection vulnerability is exploited, attackers could potentially extract confidential information from the database, modify data persisting in GLPI, and undermine the integrity of reports produced. The vulnerability could further be abused to escalate privileges within the application if exploited strategically. Data confidentiality, as it relates to stored and processed information within GLPI, could be severely compromised. Potential risks also include unauthorized data access, intellectual property theft, and regulatory compliance issues stemming from unauthorized data exposure. Security incidents related to exploited SQL injections in a critical IT management platform like GLPI could moot comprehensive damage to an organization's IT landscape.
REFERENCES
- Update to the latest version of GLPI to mitigate the vulnerability.
- Implement prepared statements and parameterized queries to prevent SQL injection on manual queries.
- Employ application-level monitoring and logging to detect and respond to potential exploitation attempts rapidly.
- Conduct regular security audits and code reviews to identify and address security weaknesses.
- Implement robust access controls to limit the number of privileged users who can exploit such vulnerabilities.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →