// For flags

CVE-2021-21324

Insecure Direct Object Reference (IDOR) on "Solutions"

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference (IDOR) on "Solutions". This vulnerability gives an unauthorized user the ability to enumerate GLPI items names (including users logins) using the knowbase search form (requires authentication). To Reproduce: Perform a valid authentication at your GLPI instance, Browse the ticket list and select any open ticket, click on Solution form, then Search a solution form that will redirect you to the endpoint /"glpi/front/knowbaseitem.php?item_itemtype=Ticket&item_items_id=18&forcetab=Knowbase$1", and the item_itemtype=Ticket parameter present in the previous URL will point to the PHP alias of glpi_tickets table, so just replace it with "Users" to point to glpi_users table instead; in the same way, item_items_id=18 will point to the related column id, so changing it too you should be able to enumerate all the content which has an alias. Since such id(s) are obviously incremental, a malicious party could exploit the vulnerability simply by guessing-based attempts.

GLPI es un paquete de software de gestión de activos y TI de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. En GLPI versiones anteriores a 9.5.4, se presenta una Referencia Directa a Objeto No Segura (IDOR) en "Solutions". Esta vulnerabilidad le otorga a un usuario no autorizado la habilidad de enumerar los nombres de los elementos de GLPI (incluyendo los inicios de sesión de los usuarios) mediante el formulario de búsqueda de la base de conocimientos (requiere autenticación). Para reproducir: Realice una autenticación válida en su instancia GLPI, Explore la lista de tickets y seleccione cualquier ticket abierto, haga clic en el formulario Solution, luego Busque un formulario de solución que lo redireccionará al endpoint /"glpi/front/knowbaseitem.php?item_itemtype=Ticket&item_items_id=18&forcetab=Knowbase$1", y el parámetro item_itemtype=Ticket presente en la URL anterior apuntará al alias de PHP de la tabla glpi_tickets, así que reemplácelo con "Users" para que apunte a la tabla glpi_users en su lugar; de la misma manera, item_items_id=18 apuntará a la identificación de la columna relacionada, así que cambiándola también deberías poder enumerar todo el contenido que presenta un alias. Dado que tales identificaciones son obviamente incrementales, una parte maliciosa podría explotar la vulnerabilidad simplemente con intentos basados ??en adivinanzas

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-22 CVE Reserved
  • 2021-03-08 CVE Published
  • 2024-03-11 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Glpi-project
Search vendor "Glpi-project"
 Glpi
Search vendor "Glpi-project" for product "Glpi"
 < 9.5.4
Search vendor "Glpi-project" for product "Glpi" and version " < 9.5.4"
-
Affected