CVE-2024-37149: Glpi-project Glpi RCE Vulnerability

CVE-2024-37149 Overview

CVE-2024-37149 is a remote code execution vulnerability in GLPI, an open-source IT asset and service management platform. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute arbitrary code on the server. The flaw combines external control of a file path ([CWE-73]) with code injection ([CWE-94]), giving attackers a reliable path from low-privileged access to full application compromise. The GLPI project fixed the issue in version 10.0.16.

Critical Impact
Authenticated technicians can achieve arbitrary PHP execution on the GLPI host, leading to full compromise of asset data, credentials, and connected inventory systems.

Affected Products

GLPI versions prior to 10.0.16
GLPI Project glpi-project/glpi
Deployments exposing technician-level accounts to untrusted users

Discovery Timeline

2024-07-10 - CVE-2024-37149 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37149

Vulnerability Analysis

GLPI supports a plugin architecture that loads PHP files from directories referenced by the application. The vulnerability allows an authenticated technician user to upload a PHP file through legitimate application functionality and then influence the plugin loader to include that file. Once included, the PHP interpreter executes the attacker-controlled code in the context of the web server user.

The issue chains two weaknesses. First, file path handling does not sufficiently restrict what the plugin loader will treat as a valid plugin entry point. Second, the uploaded content is neither validated as safe nor stored outside an executable path. The combination converts an upload feature into a code execution primitive without requiring administrative rights.

Because technician accounts are commonly issued to internal support staff and integrators, the effective attack surface is broader than an admin-only issue. A compromised technician credential is sufficient for full server takeover.

Root Cause

The root cause is improper control of the filename used in the PHP include/require path resolved by the plugin loader ([CWE-73]), compounded by improper control of code generation ([CWE-94]). The loader trusts filesystem locations that authenticated users can influence through upload functionality.

Attack Vector

The attack vector is network-based and requires authenticated access at the technician role. No user interaction is required beyond the attacker's own session. After authenticating, the adversary uploads a PHP payload and triggers the plugin loader to include and execute it. Refer to the GLPI Security Advisory GHSA-cwvp-j887-m4xh for advisory details.

Detection Methods for CVE-2024-37149

Indicators of Compromise

Unexpected .php files appearing under GLPI plugin, files, or upload directories, particularly with recent modification timestamps.
Web server processes (php-fpm, apache2, www-data) spawning shells, network utilities, or outbound connections to unknown hosts.
GLPI audit logs showing technician accounts performing file uploads followed by plugin-related requests.
HTTP requests referencing plugin loader paths immediately after file upload endpoints in access logs.

Detection Strategies

Monitor GLPI web directories for creation of PHP files by non-deployment processes and alert on any additions outside official patch cycles.
Baseline the plugin directory contents and generate alerts when new files appear without a corresponding administrative install action.
Correlate authentication events for technician-role accounts with subsequent upload and plugin execution requests.

Monitoring Recommendations

Enable verbose access logging on the GLPI web server and forward logs to a central analytics platform for query and retention.
Track process ancestry for the PHP runtime to identify anomalous child processes originating from web requests.
Review technician account activity for uploads outside normal working patterns or from unusual source IPs.

How to Mitigate CVE-2024-37149

Immediate Actions Required

Upgrade GLPI to version 10.0.16 or later, which contains the vendor fix for the plugin loader hijack.
Audit all accounts holding the technician role and remove any that are unused, shared, or over-provisioned.
Rotate credentials for technician accounts and enforce multi-factor authentication on the GLPI login interface.
Inspect plugin and upload directories for unauthorized PHP files and remove any that cannot be tied to a legitimate deployment.

Patch Information

The GLPI project released 10.0.16 to remediate CVE-2024-37149. The fix addresses the plugin loader path handling so that uploaded files cannot be resolved as executable plugin entry points. Full details are published in the GLPI GitHub Security Advisory GHSA-cwvp-j887-m4xh.

Workarounds

Restrict access to the GLPI web interface to trusted networks using a reverse proxy or VPN until the upgrade is applied.
Set filesystem permissions on plugin directories to read-only for the web server user where operationally feasible.
Configure the web server to deny PHP execution in upload and document directories using directives such as php_admin_flag engine off.

bash

# Configuration example: block PHP execution in GLPI upload paths (Apache)
<Directory "/var/www/glpi/files">
    php_admin_flag engine off
    <FilesMatch "\.(php|phar|phtml)$">
        Require all denied
    </FilesMatch>
</Directory>