CVE-2024-50339: GLPI Authentication Bypass Vulnerability

CVE-2024-50339 Overview

GLPI is a free asset and IT management software package used by organizations to track hardware, software, and support tickets. CVE-2024-50339 allows an unauthenticated attacker to retrieve all active session IDs from a vulnerable GLPI instance. The attacker can then reuse any captured session ID to impersonate a legitimate authenticated user, including administrators. The flaw affects GLPI versions 9.5.0 through 10.0.16 and is fixed in version 10.0.17. The issue maps to [CWE-384] Session Fixation and [CWE-79] Cross-site Scripting.

Critical Impact
An unauthenticated remote attacker can enumerate active session identifiers and hijack any valid GLPI session, gaining full access to the impersonated user's data and privileges.

Affected Products

GLPI 9.5.0 through 10.0.16
glpi-project/glpi package installations exposed on internal or public networks
Managed service provider environments running GLPI for asset and ticket management

Discovery Timeline

2024-12-12 - CVE-2024-50339 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50339

Vulnerability Analysis

The vulnerability lets an unauthenticated user query a GLPI endpoint that returns identifiers for all active sessions. Because GLPI relies on the session identifier as the primary authentication token after login, obtaining a valid identifier is equivalent to obtaining valid credentials. An attacker replays a captured session cookie against the GLPI web interface and is treated as the corresponding authenticated user. When the hijacked session belongs to a super-admin, the attacker gains full control over assets, tickets, users, and configured plugins. The GLPI project addressed the issue in release 10.0.17 by removing the unauthenticated exposure of session identifiers.

Root Cause

The root cause is improper access control on a session-management resource that exposes session identifiers without requiring authentication. Combined with GLPI's session handling, this design flaw permits session hijacking with no credential material. The classification under [CWE-384] Session Fixation reflects that a valid session token can be adopted by an unauthorized actor.

Attack Vector

Exploitation occurs entirely over the network with no privileges and no user interaction. An attacker reaches the vulnerable GLPI HTTP endpoint, retrieves the list of active session identifiers, selects one, and submits it as the session cookie on a subsequent request. GLPI accepts the identifier and serves content as the corresponding user. No malware, phishing, or lateral movement is required to reach the initial foothold.

The vulnerability manifests in GLPI's session management logic. See the GitHub Security Advisory GHSA-v977-g4r9-6r72 for technical details.

Detection Methods for CVE-2024-50339

Indicators of Compromise

Unauthenticated HTTP requests to GLPI session-related endpoints from unexpected source addresses
Multiple concurrent sessions for a single GLPI user account originating from different IP addresses or user agents
Sudden appearance of administrative actions such as user creation, plugin installation, or configuration changes without a matching prior login event in access logs
Requests that supply a valid PHPSESSID cookie without a preceding successful authentication in the web server log stream

Detection Strategies

Correlate GLPI application logs with web server access logs to identify sessions used from source addresses that never performed a login
Alert on GLPI users whose active session count exceeds a defined baseline within a short interval
Monitor for anomalous access to session-enumeration URIs and unauthenticated 200 responses on endpoints that should require authentication

Monitoring Recommendations

Enable verbose GLPI authentication and session logging and forward events to a central log platform
Track EPSS trending for CVE-2024-50339, currently at 19.621% probability in the 97th percentile, and prioritize accordingly
Review outbound email, ticket exports, and report downloads for unexpected volume that may indicate session-hijack driven data theft

How to Mitigate CVE-2024-50339

Immediate Actions Required

Upgrade all GLPI instances to version 10.0.17 or later without delay
Invalidate all existing GLPI sessions after upgrade and force users to re-authenticate
Restrict network exposure of GLPI to trusted networks or place the application behind a VPN or reverse proxy with authentication
Audit GLPI user accounts, API tokens, and recent administrative actions for signs of misuse

Patch Information

GLPI version 10.0.17 contains the fix. Release notes and download artifacts are available at the GLPI 10.0.17 release page. Review the GitHub Security Advisory GHSA-v977-g4r9-6r72 before applying the update.

Workarounds

No official workaround is published; upgrading to 10.0.17 is the supported remediation
If immediate patching is not possible, block unauthenticated access to GLPI at the web server or WAF layer and restrict source IP ranges
Rotate session cookies and shorten session lifetime in config/config_db.php and PHP session configuration to reduce the window of hijack reuse

bash

# Configuration example: restrict GLPI access at the reverse proxy layer
# nginx snippet limiting GLPI to a trusted management subnet
location /glpi/ {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://glpi_backend;
}