CVE-2024-45609: GLPI Asset Management XSS Vulnerability

CVE-2024-45609 Overview

CVE-2024-45609 is a reflected Cross-Site Scripting (XSS) vulnerability in GLPI, the open-source Free Asset and IT Management Software package used for data center management, ITIL service desk, license tracking, and software auditing. The flaw resides in the reports pages of the application. An unauthenticated attacker can craft a malicious link and deliver it to a GLPI technician, causing arbitrary JavaScript to execute in the technician's browser session when the link is opened. The issue is tracked as [CWE-79] and is resolved in GLPI version 10.0.17.

Critical Impact
Successful exploitation lets an attacker execute JavaScript in the context of an authenticated GLPI technician, enabling session theft, unauthorized actions, and pivoting inside the IT management platform.

Affected Products

GLPI (glpi-project) versions prior to 10.0.17
Deployments exposing the reports pages to browser-based technician access
Any GLPI instance where technicians can be targeted by social-engineered links

Discovery Timeline

2024-11-15 - CVE-2024-45609 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45609

Vulnerability Analysis

The vulnerability is a reflected XSS issue located in GLPI's reports pages. User-supplied input from URL parameters is reflected back into the rendered HTML response without adequate output encoding or sanitization. When a GLPI technician follows a crafted link, the browser interprets attacker-controlled content as executable script within the trusted GLPI origin.

Because the attack requires no authentication on the attacker's side, any external actor able to reach a technician through email, chat, or a ticket comment can trigger the flaw. The victim technician, however, must be authenticated for the payload to act with elevated privileges inside the application.

Execution in the technician's session allows the attacker to read or modify tickets, exfiltrate session cookies where not protected by HttpOnly, submit CSRF-like requests through the technician's browser, and potentially escalate access to administrative functions exposed to the compromised account.

Root Cause

The root cause is improper neutralization of input during web page generation on the reports pages ([CWE-79]). Parameters influencing report rendering are inserted into HTML output without contextual encoding, allowing <script> tags or event-handler attributes to break out of the intended data context.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL to the vulnerable reports endpoint that embeds a JavaScript payload in a reflected parameter. The attacker then delivers the link to a GLPI technician through phishing, a ticket submission, or any communication channel. When the technician opens the link while authenticated to GLPI, the payload executes in the browser under the GLPI origin. See the GLPI GitHub Security Advisory GHSA-3j2f-3j4v-hppr for vendor-provided details.

Detection Methods for CVE-2024-45609

Indicators of Compromise

Inbound requests to GLPI reports endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: substrings in query parameters.
Referer headers pointing to external domains sending technicians to internal GLPI report URLs with unusual parameter payloads.
Unexpected outbound HTTP requests originating from technician browsers to attacker-controlled domains immediately after visiting a GLPI report link.

Detection Strategies

Deploy web application firewall rules that flag reflected XSS patterns in query strings targeting /front/report* and related report paths.
Correlate GLPI web server access logs with authentication logs to detect technician sessions that opened suspicious externally-sourced report URLs.
Monitor browser telemetry or EDR process trees for technician workstations spawning script-driven network activity tied to GLPI sessions.

Monitoring Recommendations

Alert on GLPI HTTP requests where report parameters contain HTML meta-characters such as <, >, or unescaped quotes.
Track anomalous GLPI API activity performed shortly after a technician clicks an emailed or ticketed link.
Enable and review Content Security Policy (CSP) violation reports to surface injection attempts blocked in the browser.

How to Mitigate CVE-2024-45609

Immediate Actions Required

Upgrade GLPI to version 10.0.17 or later on all instances.
Rotate active technician and administrator session tokens after patching to invalidate any hijacked sessions.
Notify technicians to avoid opening report links received from untrusted sources until the patch is deployed.

Patch Information

The vendor fix is released in GLPI 10.0.17. Refer to the GLPI GitHub Security Advisory GHSA-3j2f-3j4v-hppr for the official patch details and release notes.

Workarounds

Restrict GLPI access to trusted internal networks or VPN to reduce exposure to unauthenticated attackers delivering malicious links.
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to the GLPI origin.
Set session cookies with HttpOnly and Secure flags, and enable SameSite=Lax or stricter to limit cookie exposure to injected script.

bash

# Configuration example: restrictive CSP header for GLPI (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;