CVE-2025-27147

Executive Summary

CVE-2025-27147 is a critical improper access control vulnerability in the GLPI Inventory Plugin (versions prior to 1.5.0). This plugin handles network discovery, SNMP inventory, software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). The vulnerability allows an unauthenticated attacker to bypass access controls, potentially leading to full system compromise, data exfiltration, and lateral movement within the network. The CVSS score of 8.2 (High) reflects the ease of exploitation and severe impact on confidentiality, integrity, and availability. No public proof-of-concept or exploit code is currently available, but the risk remains significant due to the plugin's widespread use in enterprise environments.

Supply Chain & Package Security

This vulnerability affects a plugin for the GLPI open-source IT asset management platform. The plugin is distributed via the GLPI marketplace and GitHub. Organizations using GLPI with the Inventory Plugin should immediately verify their version and apply the patch. The supply chain risk is moderate, as the plugin is a third-party extension, but the impact is contained to the GLPI ecosystem.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Data modification possible.
• Availability Impact: High (A:H) – Service disruption possible.

Threat Level: Critical. The combination of network accessibility, low complexity, and no authentication makes this vulnerability highly attractive to attackers. Although EPSS score is 0.0% (indicating no active exploitation observed yet), the potential for weaponization is high.

Deep Dive & Mechanics

The GLPI Inventory Plugin provides an API endpoint for agents to submit inventory data and perform tasks. The vulnerability stems from improper access control checks on these endpoints. Specifically, the plugin fails to validate authentication tokens or session credentials before processing requests for sensitive operations such as:

• Network discovery and SNMP inventory
• Software deployment
• VMWare ESX host remote inventory
• Data collection (files, Windows registry, WMI)

An attacker can craft HTTP requests to these endpoints without any authentication, allowing them to:

1. Enumerate network devices via SNMP discovery.
2. Deploy arbitrary software to managed endpoints.
3. Collect sensitive data from remote systems (e.g., registry keys, files).
4. Execute commands on VMWare ESX hosts.

The root cause is a missing requireLogin or similar access control check in the plugin's routing logic. In version 1.5.0, the developers added proper authentication checks to all sensitive endpoints.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.5.0):

// In plugin's routing file (e.g., inc/networkinventory.class.php)
public function handleRequest() {
    // No authentication check
    $action = $_GET['action'];
    switch ($action) {
        case 'discover':
            $this->discoverNetwork();
            break;
        case 'deploy':
            $this->deploySoftware();
            break;
        // ... other actions
    }
}

Patched Code (1.5.0):

// In plugin's routing file
public function handleRequest() {
    // Added authentication check
    if (!Session::haveRight('plugin_inventory', READ)) {
        http_response_code(403);
        die('Access denied');
    }
    $action = $_GET['action'];
    switch ($action) {
        case 'discover':
            $this->discoverNetwork();
            break;
        case 'deploy':
            $this->deploySoftware();
            break;
        // ... other actions
    }
}

The patch adds a call to Session::haveRight() which verifies that the current user has the required permission (plugin_inventory with READ right). This prevents unauthenticated access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running GLPI with Inventory Plugin < 1.5.0
• Network access to the GLPI web interface

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -s http://target/glpi/plugins/inventory/ajax/networkinventory.php?action=discover
   

2. Enumerate network devices:

   curl -s "http://target/glpi/plugins/inventory/ajax/networkinventory.php?action=discover&subnet=192.168.1.0/24"
   

3. Deploy malicious software:

   curl -s -X POST "http://target/glpi/plugins/inventory/ajax/softwaredeploy.php?action=deploy" \
     -d "package_id=1&target=all"
   

4. Collect sensitive data:

   curl -s "http://target/glpi/plugins/inventory/ajax/datacollection.php?action=collect&path=/etc/passwd"
   

Note: No public exploit code is available. The above examples are conceptual.

Blue Team

Detection Steps:

1. Monitor for unusual API calls:

   • Look for requests to /plugins/inventory/ajax/*.php without a valid session cookie.
   • Alert on high volume of requests to networkinventory.php or softwaredeploy.php.

2. Check logs:

   grep -E "plugins/inventory/ajax" /var/log/apache2/access.log | grep -v "HTTP/1.1\" 200"
   

3. Network monitoring:

   • Detect SNMP traffic originating from the GLPI server to unexpected subnets.
   • Monitor for outbound connections from GLPI to internal systems on ports 161 (SNMP), 443 (VMWare), or 445 (SMB).

4. Honeypot:

   • Deploy a fake GLPI instance with the vulnerable plugin to capture attacker behavior.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /glpi/plugins/inventory/ajax/*.php without authentication
• SNMP queries from GLPI server to internal subnets (e.g., 192.168.0.0/16)
• Outbound connections from GLPI to VMWare ESX hosts (port 443)
• Unusual data exfiltration via HTTP POST to external IPs

File IOCs:

• Modified files in /var/www/glpi/plugins/inventory/ (if attacker gains write access)
• Suspicious log entries in /var/log/glpi/ or Apache logs

System IOCs:

• New processes spawned by the web server user (e.g., www-data) running network scans
• Unexpected files in /tmp/ or /var/tmp/ created by the plugin

Detection Engineering

YARA Rule

rule CVE_2025_27147_GLPI_Inventory_Plugin {
    meta:
        description = "Detects exploitation attempts of CVE-2025-27147 in GLPI Inventory Plugin"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-27147"
    strings:
        $s1 = "networkinventory.php" ascii wide nocase
        $s2 = "softwaredeploy.php" ascii wide nocase
        $s3 = "datacollection.php" ascii wide nocase
        $s4 = "action=discover" ascii wide nocase
        $s5 = "action=deploy" ascii wide nocase
        $s6 = "action=collect" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 5
}

Sigma Rule

title: CVE-2025-27147 GLPI Inventory Plugin Unauthenticated Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access attempts to GLPI Inventory Plugin endpoints
author: Valters IT
date: 2025-03-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27147
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '/plugins/inventory/ajax/networkinventory.php'
            - '/plugins/inventory/ajax/softwaredeploy.php'
            - '/plugins/inventory/ajax/datacollection.php'
    condition: selection and not cs-cookie|contains 'glpi_'
falsepositives:
    - Legitimate GLPI agents with proper authentication
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-27147 GLPI Inventory Plugin Unauthenticated Access";
    flow:to_server,established;
    content:"/plugins/inventory/ajax/"; http_uri;
    content:"networkinventory.php" or "softwaredeploy.php" or "datacollection.php"; http_uri;
    pcre:"/(action=discover|action=deploy|action=collect)/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2025-27147;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the GLPI Inventory Plugin to version 1.5.0 or later.
2. Restrict network access to the GLPI web interface using firewall rules (allow only trusted IPs).
3. Enable authentication for all GLPI plugins by ensuring requireLogin is set in the plugin configuration.

Long-term Measures:

1. Implement Web Application Firewall (WAF) rules to block unauthenticated requests to plugin endpoints.
2. Conduct regular security audits of GLPI plugins and customizations.
3. Monitor for new CVEs related to GLPI and its plugins.
4. Use network segmentation to isolate GLPI servers from critical internal systems.

Workaround (if patching is not immediately possible):

• Disable the Inventory Plugin temporarily:

  cd /var/www/glpi/plugins
  mv inventory inventory.disabled
  

• Or modify the .htaccess file to require authentication for plugin endpoints:

  <LocationMatch "/glpi/plugins/inventory/ajax/">
      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /etc/apache2/.htpasswd
      Require valid-user
  </LocationMatch>
  

Valters IT
Securing digital frontiers, one CVE at a time.