CVE-2026-58256 in GRR
Summary
by MITRE • 10/27/2026
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
GRR is a resource management and reservation application designed to handle scheduling and availability tracking for shared assets within an organization. In versions prior to 4.5.0, the software contains a critical server-side request forgery vulnerability that leads directly to remote code execution through improper input validation in its LDAP integration features. The core technical flaw resides in how the application handles configuration parameters passed via the Lightweight Directory Access Protocol connector settings. Specifically, when an administrator configures or modifies the LDAP connection using fields such as ldap_filter, the system fails to adequately sanitize these inputs before writing them into a PHP include file named /personnalisation/config_ldap.inc.php. This lack of validation allows for arbitrary code injection because the application treats user-supplied configuration data as executable PHP code rather than simple string values.
The exploitation of this vulnerability requires an attacker who has obtained valid administrative credentials or can manipulate the session of an existing administrator within the GRR interface. The attack vector involves two distinct phases. First, the attacker must establish a connection to an LDAP server that they control. This step is crucial as it allows the attacker to dictate the data returned during authentication and configuration processes. Second, once connected, the attacker submits malicious PHP code disguised as valid input within the connector settings page, specifically targeting parameters like ldap_filter. Because GRR writes these inputs directly into the config_ldap.inc.php file without filtering dangerous characters or functions, the injected payload becomes part of the application's execution context whenever that configuration file is included by other scripts.
This vulnerability results in a complete compromise of the underlying server hosting the GRR instance. By achieving remote code execution through this method, an attacker can execute arbitrary commands with the privileges of the web server process. This level of access allows for data exfiltration, modification or deletion of critical reservation records, installation of backdoors, and further lateral movement within the internal network where the application resides. The impact is severe because it bypasses standard authentication mechanisms by leveraging existing administrative capabilities to escalate into full system control.
From a classification perspective, this issue aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as well as CWE-502 Deserialization of Untrusted Data if the input processing involves any form of serialization before writing. In terms of attack tactics, it corresponds to MITRE ATT&CK technique T1190 Exploit Public-Facing Application and potentially T1078 Valid Accounts since exploitation relies on administrative access. The vulnerability highlights a common pattern in legacy web applications where configuration files are dynamically generated from user input without sufficient sanitization, creating a direct path for code injection attacks.
Mitigation strategies focus primarily on upgrading the GRR software to version 4.5.0 or later, as this release addresses the input validation flaws within the LDAP connector module. For organizations unable to immediately patch due to operational constraints, implementing strict network segmentation is recommended to limit access to the administrative interface of GRR. Additionally, deploying a Web Application Firewall with rulesets capable of detecting PHP code injection patterns in HTTP requests can provide an additional layer of defense by blocking malicious payloads before they reach the application logic. Regular auditing of configuration files and ensuring that only authorized personnel have access to sensitive administration pages are also essential preventive measures against this type of vulnerability.