CVE-2025-52567

Executive Summary

CVE-2025-52567 is a Server-Side Request Forgery (SSRF) vulnerability affecting GLPI, a popular open-source IT asset and service management platform. The flaw exists in the RSS feed and external calendar planning features, allowing an authenticated attacker with low privileges to make the GLPI server send crafted requests to internal or external resources. This can lead to information disclosure, internal network scanning, or potential access to cloud metadata endpoints. The vulnerability affects all GLPI versions from 0.84 up to (but not including) 10.0.19. Previous patches (since 10.0.4) were insufficient to fully mitigate the issue. The CVSS score is 3.5 (Low), but the risk is elevated in environments where GLPI is deployed with access to sensitive internal networks.

Supply Chain & Package Security

GLPI is distributed as a PHP application via GitHub and its official website. Organizations using package managers like Composer should ensure their composer.json or composer.lock references are updated to version 10.0.19 or later. There are no known malicious packages in the supply chain related to this CVE, but administrators should verify the integrity of their GLPI installation by checking file hashes against official releases.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (limited information disclosure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. The vulnerability requires authentication and only allows limited information disclosure. However, in cloud environments, SSRF can be chained with metadata service attacks to escalate privileges.

Deep Dive & Mechanics

The vulnerability resides in the RSS feed and external calendar import functionality within GLPI's planning module. When a user configures an RSS feed or an external calendar (iCal/CalDAV), GLPI fetches the content from the provided URL. The application performs insufficient validation of the URL, allowing an attacker to specify internal IP addresses (e.g., http://169.254.169.254/, http://127.0.0.1/, http://10.0.0.1/) or other internal services.

The previous fix in version 10.0.4 attempted to block common SSRF patterns but was bypassed using techniques such as:

• URL obfuscation (e.g., using decimal IP representation, DNS rebinding, or redirects)
• Using alternative protocols (e.g., gopher://, dict://)
• Exploiting the fact that the validation was done on the initial URL but not on redirect targets

The core issue is that the curl or file_get_contents call used to fetch the RSS/calendar data does not restrict the destination IP or protocol after the initial validation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-10.0.19):

// In some RSS/calendar fetching function
function fetch_rss($url) {
    // Basic validation - easily bypassed
    if (preg_match('/^(http|https):\/\//i', $url)) {
        $content = file_get_contents($url); // No IP restriction
        return $content;
    }
    return false;
}

Patched Code (10.0.19):

function fetch_rss($url) {
    // Validate URL scheme
    if (!preg_match('/^https?:\/\//i', $url)) {
        return false;
    }
    
    // Parse URL and check host
    $parsed_url = parse_url($url);
    $host = $parsed_url['host'] ?? '';
    
    // Resolve host to IP and check if private
    $ip = gethostbyname($host);
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        // Only allow public IPs
        $content = file_get_contents($url);
        return $content;
    }
    
    return false;
}

The patch adds IP resolution and validation to ensure the target is not a private or reserved IP address. It also enforces strict URL scheme checking.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid GLPI account with permissions to create RSS feeds or external calendars.
• Network access to the GLPI server.

Exploitation Steps:

1. Identify the vulnerable endpoint: The RSS feed configuration is typically at /front/rssfeed.form.php and external calendars at /front/planningexternalevent.form.php.

2. Craft a malicious URL: Use an internal service or cloud metadata endpoint. For example:

   • AWS: http://169.254.169.254/latest/meta-data/
   • Internal service: http://127.0.0.1:8080/admin

3. Bypass basic validation (if present): Use URL encoding, redirects, or alternative representations:

   • Decimal IP: http://2130706433/ (127.0.0.1)
   • DNS rebinding: Use a domain that resolves to an internal IP after a short TTL.

4. Submit the RSS feed: The GLPI server will fetch the URL and potentially expose the response in the planning interface or logs.

Example curl command to add a malicious RSS feed:

curl -X POST 'http://target.glpi.local/front/rssfeed.form.php' \
  -d 'name=MaliciousFeed' \
  -d 'url=http://169.254.169.254/latest/meta-data/' \
  -d 'action=add' \
  -b 'cookie_file.txt'

Blue Team

Detection:

• Monitor outbound HTTP requests from the GLPI server to unexpected IPs (especially private ranges).
• Look for RSS feed or external calendar creation events with suspicious URLs.
• Check GLPI logs (/var/log/glpi/) for errors related to URL fetching.

Hunting:

• Search for RSS feeds with URLs containing private IPs, cloud metadata endpoints, or unusual ports.
• Review recent changes to glpi_rssfeeds and glpi_planningexternalevents database tables.

Prevention:

• Restrict outbound traffic from the GLPI server using a firewall or egress proxy.
• Implement network segmentation to limit the GLPI server's access to internal resources.
• Apply the patch immediately.

Indicators of Compromise (IOCs)

• Network:

  • Outbound HTTP requests from GLPI server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • Requests to cloud metadata IPs (169.254.169.254, 100.100.100.200 for Alibaba Cloud).
  • Requests to internal hostnames (e.g., localhost, intranet, internal-service).

• Logs:

  • GLPI application logs showing failed URL validation or unusual fetch attempts.
  • Web server logs (Apache/Nginx) showing POST requests to rssfeed.form.php or planningexternalevent.form.php with suspicious url parameters.

• Database:

  • Entries in glpi_rssfeeds or glpi_planningexternalevents with URLs pointing to internal IPs.

Detection Engineering

YARA Rule

rule CVE_2025_52567_GLPI_SSRF {
    meta:
        description = "Detects GLPI RSS feed or external calendar URLs targeting internal IPs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52567"
    strings:
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3})/
        $metadata_ip = /169\.254\.169\.254/
        $url_param = /url=http[s]?:\/\//
    condition:
        $url_param and ($private_ip or $metadata_ip)
}

Sigma Rule

title: GLPI SSRF via RSS Feed or External Calendar
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-52567 by creating RSS feeds or external calendars with internal IPs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: glpi
detection:
    selection:
        event: rssfeed.add or planningexternalevent.add
        url|contains:
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '127.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate internal RSS feeds (if allowed by policy)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-52567 GLPI SSRF Attempt - Internal IP in URL";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"rssfeed.form.php"; http_uri;
    content:"url="; http_client_body;
    pcre:"/url=http[s]?:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri";
    sid:10000001;
    rev:1;
    reference:cve,2025-52567;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GLPI to version 10.0.19 or later. This is the only complete fix.
2. If immediate upgrade is not possible, disable RSS feeds and external calendar features temporarily:
   • Remove permissions for non-admin users to create RSS feeds and external calendars.
   • In GLPI configuration, disable the RSS feed and external calendar plugins if they are separate.

Network-Level Mitigations:

• Implement an egress firewall that blocks outbound traffic from the GLPI server to private IP ranges (RFC 1918) and cloud metadata IPs.
• Use a web application firewall (WAF) to inspect and block requests containing internal IPs in RSS/calendar URLs.
• Deploy network segmentation so the GLPI server cannot reach sensitive internal services.

Monitoring:

• Enable detailed logging for all RSS feed and external calendar operations.
• Set up alerts for any outbound connections from the GLPI server to unexpected destinations.

Long-Term:

• Conduct a security review of all URL-fetching functionality in GLPI.
• Implement a URL allowlist for RSS feeds and external calendars.
• Regularly update GLPI to the latest version.

Valters IT