GLPI Missing Authorization in ajax/map.php for Itemtype Search

Executive Summary

This vulnerability in GLPI through 12.0.0 is a missing authorization issue in ajax/map.php. It allows authenticated low-privileged users to search for itemtypes they cannot view by bypassing the canView() check. Attackers can query restricted types like Contact, Supplier, Contract, and Budget to get match counts, titles, and coordinates within their entities.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your GLPI instance uses the vulnerable ajax/map.php endpoint. Monitor network traffic for POST requests to /ajax/map.php containing itemtype parameters like Contact, Supplier, Contract, or Budget. Verify if low-privileged users can retrieve unauthorized data such as coordinates or titles.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged users could access sensitive data such as titles, coordinates, and match counts for restricted itemtypes within their entities. This could lead to unauthorized information disclosure, potential data leaks, or misuse of restricted data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy. It may result in non-compliance with GDPR (data exposure) or HIPAA (protected health information exposure) if such data is involved.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GLPI to the latest patched version. If an update is unavailable, restrict access to ajax/map.php via firewall rules or disable the endpoint if not required. Review user permissions to ensure low-privileged accounts cannot access restricted itemtypes.

Useful 0 Not Useful 0