CVE-2024-43418: GLPI Asset Management XSS Vulnerability

CVE-2024-43418 Overview

CVE-2024-43418 is a reflected cross-site scripting (XSS) vulnerability in GLPI, an open-source asset and IT service management platform. An unauthenticated attacker can craft a malicious link and send it to a GLPI technician. When the technician follows the link, attacker-controlled JavaScript executes in the technician's browser session. The flaw is classified under CWE-79 and requires user interaction to trigger. The GLPI project addressed the issue in version 10.0.17.

Critical Impact
Attackers can hijack GLPI technician sessions, perform actions on their behalf, and pivot into privileged IT management workflows through a single crafted link.

Affected Products

GLPI versions prior to 10.0.17
Deployments exposing the GLPI web interface to end users or technicians
Any GLPI instance where technicians follow externally supplied links

Discovery Timeline

2024-11-15 - CVE-2024-43418 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43418

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the GLPI web application. Reflected XSS occurs when user-controlled input is echoed back into an HTTP response without proper output encoding. An attacker crafts a URL that embeds a malicious script payload in a request parameter. When a GLPI technician visits the URL, the server reflects the payload into the rendered page and the browser executes it in the context of the GLPI origin.

Because the payload runs inside the authenticated technician's session, the attacker can read session tokens, submit requests through the GLPI UI, alter tickets, or exfiltrate data visible to the technician. Exploitation requires user interaction, and the attack vector is network-based. GLPI is widely deployed for helpdesk and asset management, so reflected XSS against a technician account can expose organization-wide IT inventory and ticket data.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. GLPI failed to sanitize or contextually encode a user-supplied parameter before rendering it in HTML output. The upstream fix in version 10.0.17 applies the missing output encoding. See the GitHub Security Advisory GHSA-x8jv-fcwx-3x6m for maintainer details.

Attack Vector

The attack begins with an unauthenticated attacker generating a URL that embeds a JavaScript payload in a vulnerable GLPI parameter. The attacker delivers the link through phishing email, chat messages, or a poisoned ticket comment. When a technician clicks the link while logged into GLPI, the script executes with the technician's privileges. The attacker can then hijack the session, issue authenticated API calls, or stage further attacks against back-end assets managed through GLPI.

No verified public proof-of-concept code is available. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2024-43418

Indicators of Compromise

HTTP GET or POST requests to GLPI endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= payloads in query parameters
Referrer headers from external domains preceding unusual GLPI actions performed by technician accounts
Unexpected outbound requests from technician browsers to attacker-controlled domains after visiting GLPI URLs

Detection Strategies

Inspect web server and reverse proxy logs for GLPI request parameters containing HTML tags, event handlers, or encoded script markers
Deploy web application firewall (WAF) rules that detect reflected XSS patterns in requests targeting /glpi/ paths
Correlate technician account activity anomalies, such as ticket edits or exports, with immediately preceding external link clicks

Monitoring Recommendations

Enable and centralize GLPI application, PHP, and web server logs for retention and analysis
Alert on GLPI session tokens used from unexpected IP addresses or browser fingerprints within short time windows
Track outbound DNS and HTTP traffic from technician workstations to newly registered or low-reputation domains

How to Mitigate CVE-2024-43418

Immediate Actions Required

Upgrade all GLPI instances to version 10.0.17 or later without delay
Instruct technicians to avoid clicking GLPI links received from untrusted sources until the patch is applied
Rotate active technician session cookies and API tokens after upgrading

Patch Information

The GLPI project fixed the vulnerability in version 10.0.17. Administrators should apply the upgrade following the standard GLPI update procedure. Refer to the GLPI GitHub Security Advisory GHSA-x8jv-fcwx-3x6m for release notes and remediation guidance.

Workarounds

Restrict GLPI access to trusted networks or VPN tunnels to reduce exposure to external phishing links
Deploy a WAF with reflected XSS signatures in front of the GLPI application
Enforce a strict Content Security Policy (CSP) at the reverse proxy that disallows inline scripts and unknown script origins

bash

# Example nginx CSP header to reduce reflected XSS impact on GLPI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;