Teclib GLPI Agent up to 1.4 on Unix/Windows os command injection

Summaryinfo

A vulnerability was found in Teclib GLPI Agent up to 1.4 on Unix/Windows. It has been rated as critical. The affected element is an unknown function. The manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2023-34254. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Teclib GLPI Agent up to 1.4 on Unix/Windows (Asset Management Software). This issue affects an unknown function. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the agent is configured with for remoteinventory task. This vulnerability has been patched in glpi-agent 1.5.

The weakness was disclosed 06/24/2023 by Alessandro Mizzaro (Alemmi) with Wuerth Phoenix as GHSA-39vc-hxgm-j465. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-34254 since 05/31/2023. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

A public exploit has been developed by Alessandro Mizzaro/Thomas Forrer (Alemmi/u238) in Python/Rust/Perl. The exploit is available at github.com. It is declared as proof-of-concept.

Upgrading to version 1.5 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Asset Management Software

Vendor

• Teclib

Name

• GLPI Agent

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion