CVE-2025-53112

Executive Summary

CVE-2025-53112 is a medium-severity vulnerability in GLPI, a popular open-source IT asset and service management software. The flaw resides in a missing authorization check, allowing an authenticated user with low privileges to delete specific resources they should not have access to. This could lead to unauthorized data removal or service disruption. The vulnerability affects versions from 9.1.0 up to (but not including) 10.0.19. The patch is available in version 10.0.19. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

GLPI is a PHP-based application distributed via GitHub and its official website. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations using GLPI should treat this as a critical supply chain risk if they rely on unpatched versions, as an attacker could disrupt IT operations by deleting essential configuration or asset data.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact stays within the component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Unauthorized deletion of resources.
• Availability (A): None (N) – Not directly affecting availability, though deletion of critical resources could lead to service degradation.

Threat Level: Medium. The low EPSS score (0.0%) suggests no active exploitation in the wild, but the vulnerability is trivial to exploit once an attacker has a low-privilege account.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862) . In GLPI, certain API endpoints or UI actions that delete resources (e.g., tickets, assets, or configuration items) do not properly verify if the authenticated user has the required permissions. The code likely checks if the resource exists but fails to validate the user's role or ownership before performing the deletion.

Root Cause: The delete action in a controller or model does not call an authorization check function (e.g., canDelete() or checkRight()). This allows any authenticated user to send a crafted request to delete resources that should be restricted to administrators or specific roles.

Attack Scenario:

1. An attacker gains access to a low-privilege GLPI account (e.g., via phishing, credential stuffing, or a previous vulnerability).
2. The attacker identifies the vulnerable endpoint (e.g., /front/ticket.form.php?id=X&delete=1 or an API route).
3. The attacker sends a DELETE request to the endpoint with the ID of a resource they should not be able to delete.
4. The server processes the request without checking permissions, deleting the resource.

Vulnerable vs. Patched Code

Vulnerable Code (Example - PHP):

// In some controller or model
public function delete($id) {
    $item = $this->find($id);
    if ($item) {
        $item->delete(); // No permission check
        return true;
    }
    return false;
}

Patched Code (Example - PHP):

public function delete($id) {
    $item = $this->find($id);
    if ($item && $this->canDelete($item)) { // Added authorization check
        $item->delete();
        return true;
    }
    return false;
}

private function canDelete($item) {
    return Session::haveRight('delete', $item->getType());
}

The patch adds a call to canDelete() (or equivalent) before performing the deletion, ensuring only users with the appropriate rights can delete the resource.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid low-privilege GLPI account (e.g., "normal user" role).
• Network access to the GLPI instance.
• Knowledge of the vulnerable endpoint (e.g., ticket deletion).

Exploitation Steps:

1. Log in to GLPI with the low-privilege account.
2. Identify a resource ID to delete (e.g., a ticket ID from the URL).
3. Send a crafted HTTP request to delete the resource.

Example Request (cURL):

curl -X POST \
  'https://target.glpi.local/front/ticket.form.php' \
  -H 'Cookie: glpi_xxx=session_cookie' \
  -d 'id=123&delete=1'

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual DELETE requests to GLPI endpoints from low-privilege users.
• Look for rapid deletion of multiple resources (e.g., tickets, assets) by a single user.
• Alert on failed authorization attempts (if logging is enabled).

Hardening:

• Immediately upgrade to GLPI 10.0.19 or later.
• Implement strict access controls and review user roles.
• Enable audit logging for all delete operations.
• Use a Web Application Firewall (WAF) to block suspicious DELETE requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /front/ticket.form.php or similar endpoints with delete=1 parameter from low-privilege users.
  • Unusual volume of DELETE requests from a single IP or user session.
• System IOCs:
  • Missing or deleted tickets, assets, or configuration items in GLPI.
  • Audit logs showing unauthorized delete actions (if enabled).
• File IOCs:
  • Modified GLPI log files (e.g., var/log/glpi.log) showing delete operations without proper authorization.

Detection Engineering

YARA Rule

rule CVE_2025_53112_GLPI_Unauthorized_Delete {
    meta:
        description = "Detects potential exploitation of CVE-2025-53112 in GLPI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-53112"
    strings:
        $s1 = "delete" nocase
        $s2 = "ticket.form.php" nocase
        $s3 = "id=" nocase
    condition:
        all of them and filesize < 10KB
}

Sigma Rule

title: GLPI Unauthorized Resource Deletion (CVE-2025-53112)
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests attempting to delete resources in GLPI without proper authorization.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'delete=1'
        cs-uri-query|contains: 'id='
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"GLPI Unauthorized Resource Deletion (CVE-2025-53112)";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"delete=1"; http_client_body;
    content:"id="; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-53112;
    classtype:attempted-user;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GLPI to version 10.0.19 or later. This is the only complete fix.
2. If immediate upgrade is not possible, disable the vulnerable endpoints via web server configuration (e.g., block POST requests to /front/ticket.form.php with delete=1 parameter).
3. Review and restrict user permissions – ensure only administrators have delete rights.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block unauthorized delete requests.
• Enable comprehensive audit logging and monitor for suspicious activity.
• Conduct regular security reviews of GLPI configurations and user roles.
• Subscribe to GLPI security advisories for future patches.

Valters IT Signature

Report generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valters.it.