CVE-2025-24801

Executive Summary

CVE-2025-24801 is a critical vulnerability in GLPI, a popular open-source IT asset management software. An authenticated user can upload and force the execution of arbitrary PHP files on the GLPI server. This allows an attacker to achieve remote code execution (RCE) with the privileges of the web server user, leading to full compromise of the GLPI instance and potentially the underlying server. The vulnerability is fixed in GLPI version 10.0.18. Given the high CVSS score of 8.6 and the potential for complete system takeover, this vulnerability requires immediate attention.

Supply Chain & Package Security

GLPI is a PHP application distributed via GitHub and its official website. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. The supply chain risk is moderate, as the vulnerability is in the application itself, not a dependency. However, organizations using GLPI should verify they are not running a forked or modified version that may not have the patch applied.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) - Requires an authenticated user account.
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. The low attack complexity and network vector, combined with the high impact on confidentiality, integrity, and availability, make this a severe threat. An attacker with a low-privilege account can achieve full remote code execution.

Deep Dive & Mechanics

The vulnerability lies in the file upload functionality of GLPI. The application fails to properly validate the file type and does not restrict the execution of PHP files in the upload directory. An authenticated user can upload a malicious PHP file (e.g., a web shell) through a legitimate upload feature (e.g., document attachment, ticket attachment). The uploaded file is stored in a directory that is accessible via the web server. When the attacker accesses the uploaded file directly via its URL, the PHP code is executed by the server, leading to remote code execution.

The root cause is a lack of proper file type validation and the absence of a .htaccess or equivalent configuration to prevent PHP execution in the upload directory. The patch in version 10.0.18 addresses this by:

1. Validating the file extension and MIME type more strictly.
2. Adding a .htaccess file to the upload directory to deny access to PHP files.
3. Disabling the exec and system PHP functions for the upload directory context.

Vulnerable vs. Patched Code

Vulnerable Code (GLPI < 10.0.18): The vulnerable code likely resides in the file upload handler. A simplified example:

// Vulnerable: No file type validation
$uploadDir = GLPI_ROOT . "/files/_uploads/";
$filename = basename($_FILES['file']['name']);
move_uploaded_file($_FILES['file']['tmp_name'], $uploadDir . $filename);

Patched Code (GLPI 10.0.18): The patched code adds validation and a .htaccess file:

// Patched: Validate file extension and MIME type
$uploadDir = GLPI_ROOT . "/files/_uploads/";
$allowedExtensions = ['pdf', 'doc', 'docx', 'xls', 'xlsx', 'png', 'jpg', 'jpeg', 'gif'];
$extension = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
if (!in_array($extension, $allowedExtensions)) {
    throw new \Exception('Invalid file type');
}
$filename = uniqid() . '.' . $extension;
move_uploaded_file($_FILES['file']['tmp_name'], $uploadDir . $filename);

// Also, a .htaccess file is placed in the upload directory:
// Deny access to PHP files
<FilesMatch "\.php$">
    Deny from all
</FilesMatch>

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A GLPI instance running version < 10.0.18.
• An authenticated user account (any role with file upload permissions, e.g., "Technician").

Steps:

1. Craft a PHP Web Shell: Create a file named shell.php with the following content:

   <?php system($_GET['cmd']); ?>
   

2. Upload the Shell: Log in to GLPI, navigate to a feature that allows file uploads (e.g., creating a ticket and attaching a file). Upload shell.php.
3. Locate the Uploaded File: The file will be stored in the files/_uploads/ directory. The filename may be changed, but the extension remains .php. Note the URL (e.g., https://target.com/glpi/files/_uploads/shell.php).
4. Execute Commands: Access the uploaded file with a command parameter:

   https://target.com/glpi/files/_uploads/shell.php?cmd=id
   

   The server will execute the id command and return the output.

Automated Exploitation (Metasploit): A Metasploit module can be created to automate this process. The module would:

• Authenticate to GLPI.
• Upload a PHP payload.
• Execute commands via the uploaded shell.

Blue Team (Defense & Detection)

Detection:

• Monitor for file uploads with .php extension in GLPI.
• Monitor for access to files in the files/_uploads/ directory with .php extension.
• Look for unusual HTTP requests to GLPI upload endpoints.

Hunting:

• Search for files with .php extension in the files/_uploads/ directory.
• Review GLPI access logs for requests to files/_uploads/*.php.
• Check for the presence of a .htaccess file in the upload directory.

Prevention:

• Apply the patch to upgrade to GLPI 10.0.18 immediately.
• If patching is not possible, manually add a .htaccess file to the upload directory with the following content:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

• Restrict file upload permissions to only trusted users.
• Use a Web Application Firewall (WAF) to block uploads of PHP files.

Indicators of Compromise (IOCs)

• File: files/_uploads/*.php (any PHP file in the upload directory)
• Network: HTTP requests to /glpi/files/_uploads/*.php with a cmd parameter.
• Logs: GLPI access logs showing requests to files/_uploads/*.php.
• Process: Web server process executing PHP files from the upload directory.

Detection Engineering

YARA Rule

rule CVE_2025_24801_GLPI_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2025-24801 in GLPI upload directory"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-24801"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $exec_func = /exec\s*\(/
        $shell_exec = /shell_exec\s*\(/
        $passthru = /passthru\s*\(/
    condition:
        $php_tag and any of ($system_func, $exec_func, $shell_exec, $passthru)
}

Sigma Rule

title: GLPI PHP File Upload Exploitation (CVE-2025-24801)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to PHP files in the GLPI upload directory, indicating possible exploitation of CVE-2025-24801.
author: Valters IT
date: 2025/02/20
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-extension: ".php"
        cs-uri-path|contains: "/files/_uploads/"
    condition: selection
falsepositives:
    - Legitimate PHP files in upload directory (unlikely if patched)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-24801 - GLPI PHP File Upload Exploitation";
    flow:to_server,established;
    content:"/files/_uploads/"; http_uri;
    content:".php"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-24801;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GLPI: Upgrade to version 10.0.18 or later immediately.
2. Manual Mitigation: If upgrade is not possible, add a .htaccess file to the files/_uploads/ directory to deny access to PHP files.
3. Review Uploads: Scan the files/_uploads/ directory for any PHP files and remove them.
4. Rotate Credentials: Change all GLPI user passwords, especially those with file upload permissions.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to block malicious file uploads.
• Regularly update GLPI to the latest version.
• Conduct security audits of the GLPI configuration.
• Restrict file upload permissions to only necessary users.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact intel@valters-it.com.