CVE-2024-11955: GLPI Open Redirect Vulnerability

CVE-2024-11955 Overview

CVE-2024-11955 is an open redirect vulnerability affecting GLPI (Gestionnaire Libre de Parc Informatique) versions up to and including 10.0.17. The flaw resides in /index.php, where the redirect parameter is not properly validated. Attackers can craft URLs that redirect authenticated or targeted users to attacker-controlled destinations after they interact with a malicious link. The issue is classified under CWE-601: URL Redirection to Untrusted Site. The GLPI project addressed the flaw in version 10.0.18.

Critical Impact
Attackers can weaponize the trusted GLPI domain to redirect users to phishing or malware-hosting sites, enabling credential theft and social engineering campaigns.

Affected Products

GLPI Project GLPI versions up to and including 10.0.17
Deployments exposing the GLPI /index.php endpoint to end users
Self-hosted GLPI IT asset and service management instances

Discovery Timeline

2025-02-25 - CVE-2024-11955 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11955

Vulnerability Analysis

GLPI is an open-source IT service management and asset tracking platform used across enterprises and public-sector organizations. The vulnerability resides in the handling of the redirect query parameter processed by /index.php. The application accepts the parameter and forwards the user to the supplied location without validating whether the destination belongs to a trusted origin. This behavior enables an unauthenticated attacker to craft URLs that appear to originate from the legitimate GLPI host but land users on external, attacker-controlled infrastructure. User interaction is required, which typically comes in the form of a phishing email or chat message containing the malicious link.

Root Cause

The root cause is missing allowlist validation on the redirect parameter before the redirection response is issued. GLPI treated the parameter as trusted input and did not restrict destinations to internal application paths or a pre-approved origin list. This aligns with the pattern described in CWE-601. Version 10.0.18 introduces validation that constrains redirection targets, as documented in the GLPI Security Advisory GHSA-g5fm-jq4j-c2c7.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker constructs a URL such as https://<glpi-host>/index.php?redirect=https://attacker.example/phish and delivers it through phishing, social engineering, or watering-hole tactics. The victim inspects the domain, trusts the GLPI hostname, and follows the link. The GLPI server issues the redirect and drops the user on the attacker's page, which commonly mimics a GLPI or corporate SSO login flow to harvest credentials or deliver malware.

See the GLPI Security Advisory for a technical description of the vulnerable parameter handling.

Detection Methods for CVE-2024-11955

Indicators of Compromise

Web server access logs containing requests to /index.php with a redirect= parameter pointing to an external domain
Referrer headers showing users arriving at unrelated third-party sites from your GLPI hostname
Phishing reports from users referencing links that begin with your legitimate GLPI URL
Outbound DNS or proxy logs showing users transitioning from the GLPI host to newly registered domains

Detection Strategies

Parse HTTP access logs for /index.php?redirect= values and flag any target host not on an approved allowlist
Compare the Host header of the request with the destination in the redirect parameter and alert on mismatches
Correlate email gateway URL rewriting data with GLPI hostname traffic to identify phishing lures abusing the parameter
Track GLPI version banners across the environment to identify instances still running 10.0.17 or earlier

Monitoring Recommendations

Enable verbose web server logging on all GLPI front-ends to capture full query strings
Forward GLPI, reverse-proxy, and WAF logs to a central analytics platform for correlation across users and endpoints
Baseline typical redirect destinations for /index.php and alert on deviations
Monitor for spikes in redirect= usage that could indicate an active phishing campaign

How to Mitigate CVE-2024-11955

Immediate Actions Required

Upgrade all GLPI instances to version 10.0.18 or later using the GLPI 10.0.18 release
Inventory internet-exposed GLPI deployments and prioritize public-facing instances for patching first
Notify users that legitimate GLPI links will not redirect off-domain and encourage reporting of suspicious URLs
Review recent web logs for prior abuse of the redirect parameter

Patch Information

The GLPI project released version 10.0.18 to remediate this issue. Details are available in GitHub Security Advisory GHSA-g5fm-jq4j-c2c7 and the 10.0.18 release notes. Additional entries are tracked in VulDB #296809.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks or sanitizes external URLs in the redirect query parameter on /index.php
Restrict access to the GLPI application to authenticated users on a VPN or zero-trust network while patching
Implement browser and email security controls that warn users about redirect chains crossing trust boundaries
Educate helpdesk and end users to inspect the full URL, not just the initial hostname, before authenticating

bash

# Example WAF rule (ModSecurity) blocking off-domain redirect targets
SecRule REQUEST_URI "@beginsWith /index.php" \
    "chain,phase:2,deny,status:403,id:1009551,\
     msg:'CVE-2024-11955 GLPI open redirect attempt'"
    SecRule ARGS:redirect "@rx ^(https?:)?//(?!your-glpi-host\.example/)" \
        "t:none,t:lowercase"