CVE-2025-52897

Executive Summary

CVE-2025-52897 is a medium-severity vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a popular open-source IT asset management software. The flaw resides in the planning feature, allowing an unauthenticated attacker to craft a malicious link that, when clicked by a legitimate user, can redirect them to an external, attacker-controlled site. This is a classic open redirect vulnerability (CWE-601) that can be weaponized for phishing campaigns, credential harvesting, or malware distribution. The attack requires user interaction (clicking the link), but no authentication is needed to generate the malicious payload. The vulnerability affects all versions from 9.1.0 up to (but not including) 10.0.19. The official patch was released in version 10.0.19.

Supply Chain & Package Security

GLPI is distributed as a PHP application via its official website and GitHub releases. While not a package manager-based distribution (like NPM or PyPI), the risk to the supply chain is significant if an organization uses an unpatched version. An attacker could compromise a GLPI instance and use it as a pivot point to launch phishing attacks against internal users, potentially leading to credential theft and lateral movement within the organization's network.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim must click the malicious link.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) - No direct data exposure.
• Integrity (I): High (H) - The attacker can redirect the user to a malicious site, potentially altering the perceived integrity of the communication.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is 6.5, the real-world risk is elevated due to the low complexity and the potential for use in targeted phishing attacks against organizations using GLPI.

Deep Dive & Mechanics

The vulnerability exists in the planning feature of GLPI. This feature allows users to create and manage events, tasks, and appointments. The core issue is that the application does not properly validate or sanitize user-supplied input when constructing URLs for the planning feature. An unauthenticated attacker can craft a URL that, when processed by the GLPI application, redirects the user's browser to an arbitrary external domain.

The attack flow is as follows:

1. Attacker Crafts Malicious URL: The attacker constructs a URL that points to the vulnerable GLPI instance, but includes a parameter (likely related to the planning feature's redirect or callback mechanism) that specifies an external URL.
2. Attacker Distributes Link: The attacker sends this link to a target user via email, social media, or other communication channels. The link may be disguised as a legitimate GLPI notification or invitation.
3. Victim Clicks Link: The victim, who may be an authenticated GLPI user, clicks the link.
4. GLPI Processes Request: The GLPI application processes the request. Due to the lack of validation, it uses the attacker-supplied external URL as the redirect target.
5. Victim is Redirected: The victim's browser is redirected to the attacker-controlled site. This site could be a phishing page mimicking the GLPI login screen, a credential harvester, or a malware dropper.

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). This is a common web application security flaw that can have severe consequences when combined with social engineering.

Vulnerable vs. Patched Code

The vulnerable code likely resides in a PHP file handling the planning feature's redirect logic. A simplified example of the vulnerable pattern is:

// Vulnerable Code (Conceptual)
$redirect_url = $_GET['redirect'];
header('Location: ' . $redirect_url);
exit;

The patched code would include validation to ensure the redirect URL is internal or belongs to a whitelist of trusted domains:

// Patched Code (Conceptual)
$redirect_url = $_GET['redirect'];
$allowed_hosts = ['example.com', 'glpi.internal'];
$parsed_url = parse_url($redirect_url);
if (in_array($parsed_url['host'], $allowed_hosts)) {
    header('Location: ' . $redirect_url);
    exit;
} else {
    // Log the attempt and show an error
    error_log('Blocked redirect to: ' . $redirect_url);
    die('Invalid redirect target.');
}

The actual patch in GLPI 10.0.19 likely implements similar validation, ensuring that the redirect parameter (or equivalent) only points to the same GLPI instance or a pre-approved list of URLs.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Demonstrate the open redirect vulnerability.

Lab Setup:

1. Vulnerable GLPI Instance: Deploy GLPI version 10.0.18 (or any version between 9.1.0 and 10.0.18) in a controlled environment (e.g., Docker, local VM).
2. Attacker Server: Set up a simple HTTP server (e.g., using Python's http.server) to simulate the malicious landing page.
3. Victim Browser: Use a standard web browser.

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on the description, it is related to the planning feature. A typical URL might look like:

   http://target-glpi/planning.php?redirect=http://attacker-server/malicious.html
   

2. Craft the malicious link. The exact parameter name may vary. Common parameters for redirects include redirect, url, next, return, etc.
3. Send the link to the victim (in a lab, simply click it yourself).
4. Observe the browser redirect to the attacker's server.

Example Malicious URL (Hypothetical):

http://target-glpi/front/planning.php?redirect=http://192.168.1.100:8080/phishing.html

Blue Team (Defensive)

Objective: Detect and prevent exploitation of the open redirect.

Detection Steps:

1. Web Server Logs: Monitor for requests to planning-related endpoints (e.g., planning.php) that contain suspicious redirect parameters pointing to external domains.
2. Network Traffic: Look for HTTP 302 redirect responses from the GLPI server to external IP addresses or domains.
3. User Reports: Educate users to report suspicious links that appear to come from GLPI but lead to unexpected websites.

Prevention Steps:

1. Patch Immediately: Upgrade to GLPI version 10.0.19 or later.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests to planning endpoints with redirect parameters that do not match the internal domain.
3. Input Validation: If patching is not immediately possible, implement a reverse proxy or code-level fix to validate the redirect parameter against a whitelist of allowed hosts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /front/planning.php (or similar) with a redirect parameter containing an external URL.
  • HTTP 302 redirect responses from the GLPI server to an external domain.
  • Outbound connections from the GLPI server to suspicious external IP addresses (if the redirect is followed by a server-side component).

• Host IOCs:

  • Web server access logs showing the above patterns.
  • GLPI application logs (if enabled) showing redirect attempts to external URLs.

• Email IOCs:

  • Phishing emails containing links to the GLPI instance with suspicious redirect parameters.

Detection Engineering

YARA Rule

rule Detect_GLPI_Open_Redirect_CVE_2025_52897 {
    meta:
        description = "Detects potential exploitation of CVE-2025-52897 in GLPI logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52897"
        severity = "medium"
    strings:
        $redirect_param = /redirect\s*=\s*https?:\/\// nocase
        $planning_endpoint = /planning\.php/ nocase
    condition:
        $redirect_param and $planning_endpoint
}

Sigma Rule

title: GLPI Open Redirect Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-52897 by monitoring for suspicious redirect parameters in GLPI planning feature requests.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - 'redirect=http://'
            - 'redirect=https://'
        cs-uri-stem|contains: 'planning.php'
    condition: selection
falsepositives:
    - Legitimate use of redirects to internal resources (if any)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"GLPI Open Redirect Exploit (CVE-2025-52897)";
    flow:to_server,established;
    content:"planning.php"; http_uri;
    content:"redirect="; http_uri;
    pcre:"/redirect\s*=\s*https?:\/\//Ui";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-52897;
)

Remediation & Mitigation

1. Immediate Patch: Upgrade all GLPI instances to version 10.0.19 or later. This is the official fix provided by the vendor.
2. Virtual Patching: If immediate patching is not possible, deploy a WAF rule to block requests to planning endpoints with external redirect parameters.
3. Network Segmentation: Ensure that the GLPI server is not directly accessible from the internet if possible. Use a VPN or bastion host for administrative access.
4. User Awareness Training: Educate users about phishing attacks and how to identify suspicious links, especially those that appear to come from internal systems like GLPI.
5. Log Monitoring: Enable and monitor web server and application logs for signs of exploitation attempts.
6. Code Review: If you have custom modifications to GLPI, review the planning feature code for similar open redirect vulnerabilities.

Report generated by Valters IT DevSecOps & CTI Division