CVE-2024-43417: GLPI Asset Management XSS Vulnerability

CVE-2024-43417 Overview

CVE-2024-43417 is a reflected Cross-Site Scripting (XSS) vulnerability in GLPI, an open-source asset and IT management software package. The flaw resides in the Software form and allows an unauthenticated attacker to craft a malicious link. When a GLPI technician clicks the link, the payload executes in their browser session under the GLPI application origin. Successful exploitation can lead to session data exposure, unauthorized actions performed as the technician, and pivoting into further internal reconnaissance. The vendor released GLPI 10.0.17 to remediate the issue. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a technician's browser by delivering a crafted URL, enabling session abuse and privileged UI actions within GLPI.

Affected Products

GLPI versions prior to 10.0.17
glpi-project/glpi (open-source distribution)
Self-hosted GLPI deployments exposing the Software form to authenticated technicians

Discovery Timeline

2024-11-15 - CVE-2024-43417 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43417

Vulnerability Analysis

The vulnerability is a reflected XSS flaw located in the GLPI Software form. User-supplied input reaches the rendered HTML response without proper contextual output encoding. An unauthenticated attacker crafts a URL containing a JavaScript payload and delivers it to a GLPI technician through phishing, chat, or ticket content. When the technician follows the link while authenticated, the browser executes the payload under the GLPI origin.

Because the payload runs with the technician's authenticated session, an attacker can read DOM content, extract CSRF tokens, invoke authenticated API calls, or modify assets managed through GLPI. User interaction is required, which limits mass exploitation, but the technician-privileged execution context increases the operational impact within IT service management workflows.

Root Cause

The root cause is insufficient sanitization and output encoding of parameters processed by the Software form. Input reflected into HTML context is not encoded to prevent script execution, matching the CWE-79 pattern. Refer to the GLPI GitHub Security Advisory GHSA-p633-wfj5-8x44 for maintainer-provided technical detail.

Attack Vector

The attack vector is network-based and requires social engineering. An attacker sends a malicious link that targets the GLPI Software form endpoint. When a logged-in technician opens the link, the injected script runs in their session, allowing action-on-behalf, credential theft via fake prompts, or exfiltration of ticket and inventory data.

No verified public proof-of-concept code is available. See the vendor advisory for remediation guidance.

Detection Methods for CVE-2024-43417

Indicators of Compromise

Inbound requests to GLPI Software form URLs containing HTML metacharacters, <script>, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers on GLPI sessions originating from external email, chat, or unknown domains just before anomalous authenticated actions.
Unexpected outbound requests from technician browsers to attacker-controlled domains following interaction with a GLPI link.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set to identify reflected XSS patterns targeting /front/software.* and related GLPI form endpoints.
Enable and monitor Content Security Policy (CSP) violation reports to detect inline script execution attempts within the GLPI origin.
Correlate GLPI application logs with proxy and email gateway telemetry to flag technician clicks on external URLs that redirect to GLPI parameters carrying script payloads.

Monitoring Recommendations

Alert on GLPI HTTP 200 responses that reflect request parameters containing script tags or JavaScript URI schemes.
Monitor for privileged GLPI API calls issued from technician sessions within seconds of an inbound external link click.
Track version banners across GLPI deployments to identify hosts still running builds prior to 10.0.17.

How to Mitigate CVE-2024-43417

Immediate Actions Required

Upgrade all GLPI instances to version 10.0.17 or later without delay.
Restrict GLPI administrative and technician interfaces to trusted networks or VPN access where feasible.
Brief technicians to avoid clicking GLPI links received from untrusted sources until patching is confirmed.

Patch Information

The GLPI maintainers fixed CVE-2024-43417 in GLPI 10.0.17. Administrators should upgrade following the standard GLPI update procedure and verify the deployed version through the application's About page or CLI. Full remediation details are documented in the GLPI GHSA-p633-wfj5-8x44 advisory.

Workarounds

Apply a WAF signature that blocks requests to the Software form containing script tags, event handlers, or javascript: URIs.
Enforce a strict Content Security Policy on the GLPI origin to disallow inline scripts and restrict script sources.
Limit exposure of the GLPI web interface to the public internet by placing it behind an authenticating reverse proxy.

bash

# Example nginx CSP header to reduce reflected XSS impact on GLPI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;