CVE-2022-35946 in GLPI
Summary
by MITRE • 09/14/2022
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used to access low-level API of Plugin class. An attacker can, for instance, alter database data. Attacker must have "General setup" update rights to be able to perform this attack. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should remove the `front/plugin.form.php` script.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2022
CVE-2022-35946 represents a critical authorization bypass vulnerability within the GLPI asset and IT management platform that stems from inadequate input validation in the plugin controller component. This vulnerability exists in versions prior to 10.0.3 and allows authenticated attackers with specific privileges to exploit a path traversal mechanism that grants access to low-level API functions of the Plugin class. The flaw specifically resides in how the system processes user input within the plugin controller, where insufficient sanitization permits malicious manipulation of request parameters that should remain protected. This vulnerability operates under CWE-285 which classifies it as an authorization bypass through user control of the API path, and aligns with ATT&CK technique T1078.004 for valid accounts and T1566.001 for spearphishing attachments, as attackers must first establish valid credentials before exploiting this weakness.
The technical exploitation of this vulnerability requires an attacker to possess "General setup" update rights, which represents a moderate privilege level within the GLPI access control model. Once these privileges are obtained, the attacker can manipulate the plugin controller to access restricted API endpoints that should normally be protected from direct user interaction. The vulnerability specifically targets the `front/plugin.form.php` script which serves as the primary interface for plugin management operations. Through careful manipulation of input parameters, an attacker can effectively bypass normal access controls and gain unauthorized access to database modification functions, potentially leading to data corruption, unauthorized data manipulation, or complete system compromise. This represents a significant escalation of privilege vulnerability that transforms standard administrative capabilities into full system control.
The operational impact of CVE-2022-35946 extends beyond simple data modification to encompass potential system-wide compromise through unauthorized plugin manipulation and database access. Attackers leveraging this vulnerability can perform unauthorized changes to system configuration, manipulate asset tracking data, corrupt license information, and potentially gain access to sensitive user information stored within the GLPI database. The vulnerability's impact is particularly concerning in enterprise environments where GLPI serves as the central asset management system, as it could enable attackers to disrupt IT operations, hide malicious activities, or establish persistent access points. Organizations using GLPI for ITIL service desk operations face additional risk as attackers could manipulate incident tracking data or service catalog information, potentially causing operational disruptions and security incidents. The vulnerability also aligns with ATT&CK technique T1484.001 for cloud service account manipulation, as it could enable attackers to compromise system integrity through unauthorized plugin installations or modifications.
The recommended mitigation strategy involves immediate upgrading to GLPI version 10.0.3 which includes proper input validation controls and access restriction mechanisms for the plugin controller. For organizations unable to perform the upgrade immediately, the security advisory recommends removing the vulnerable `front/plugin.form.php` script entirely, which effectively eliminates the attack surface while maintaining core functionality. Additional defensive measures should include implementing strict access controls for "General setup" privileges, monitoring for unusual plugin activity or unauthorized configuration changes, and conducting regular security audits of plugin installations. Network segmentation and privileged access management solutions can further reduce the risk by limiting the attack surface and preventing lateral movement within the network. The vulnerability also highlights the importance of input validation practices and proper access control implementation as outlined in OWASP Top 10 2021 category A03: Injection and A07: Identification and Authentication Failures, emphasizing the need for robust application security controls in management interfaces. Organizations should also consider implementing automated patch management processes to ensure timely remediation of similar vulnerabilities across their IT infrastructure.