CVE-2023-22722 in GLPI
Summary
by MITRE • 01/26/2023
GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/20/2023
The vulnerability CVE-2023-22722 represents a critical cross-site scripting flaw affecting GLPI versions 9.4.0 through 10.0.5, with the issue stemming from insufficient input validation and output encoding mechanisms within the application's web interface. This vulnerability falls under the CWE-79 category of Cross-Site Scripting, which is classified as a persistent security weakness that allows attackers to inject malicious scripts into web applications. The flaw specifically manifests when the application fails to properly sanitize user-supplied data before rendering it in web pages, creating an environment where malicious payloads can be executed in the context of a victim's browser session.
The exploitation mechanism for this vulnerability relies on social engineering techniques where attackers craft malicious URLs containing specially crafted script payloads designed to exploit the input validation gaps in GLPI's web interface. When a victim clicks on such a malicious link, the injected script executes within their browser session, potentially allowing the attacker to perform actions as the victim or to steal session cookies that could be used for unauthorized access to the application. This type of attack aligns with the ATT&CK technique T1566.001 which describes social engineering via spearphishing attachments or links, and represents a significant threat to organizations relying on GLPI for asset and IT management operations.
The operational impact of this vulnerability extends beyond simple session hijacking, as successful exploitation could enable attackers to access sensitive organizational data, manipulate asset records, or potentially escalate privileges within the GLPI environment. Organizations using affected versions of GLPI face increased risk of data breaches and unauthorized access to their IT asset management systems, which could compromise the integrity and availability of critical infrastructure information. The vulnerability affects the core functionality of GLPI's web interface, making it a high-priority issue that requires immediate attention and remediation to protect against potential compromise of the entire IT management ecosystem.
The recommended mitigation strategy involves immediate deployment of the patched version 10.0.6, which addresses the XSS vulnerability through proper input sanitization and output encoding mechanisms. Organizations should also implement additional security measures including web application firewalls, regular security scanning of the GLPI installation, and user education to prevent successful social engineering attacks. The patch addresses the underlying CWE-79 weakness by ensuring that all user inputs are properly validated and escaped before being rendered in web pages, thereby preventing the execution of malicious scripts. Additionally, organizations should conduct thorough security assessments of their GLPI deployments to identify any other potential vulnerabilities and establish monitoring procedures to detect suspicious activities that may indicate exploitation attempts.