Description

An attacker with a low privileged account on the latest GLPI version could change other user´s email when saving his own user preferences. After that, if "Forgot password" is enabled via email, an attacker will be able to retrieve victim´s forgot password link to the modified email to complete the account takeover.

Proof of Concept

I´ve created a GLPI instance at https://services.glpi-network.com/login, with the latest version 10.0.6. There will be three users:

• Super admin - used to create victim and attacker users.
• victimUser : Victim that will suffer the attack
• attackerUser : evil attacker that will harm victim account.

At the beginning users on the admin configuration look like that:

Login with the attackerUser account (low privileged) and go to "My Settings" tab at profile options. In this case: https://bountyglpi.with18.glpi-network.cloud/front/preference.php

Save the profile and intercept the request with Burp:

Notice the fileds:

Content-Disposition: form-data; name="_default_email"

3
------WebKitFormBoundaryitdBuCBRGWdtm7aA
Content-Disposition: form-data; name="_useremails[3]"

attacker@gmail.com

Where the _default_email id = 3 is asociated to AttackerUser and _useremails[3] value is set on the second field = attacker@gmail.com.

Modify both 3 with a 2, in order to modify user with id = 2 data, this will be the victimUser but it could be also done with id = 1, admin user.

Intercepted request will show like:

Attack has been done succesfully, an attackerUser has modified vicitmUser account. If forgot password by email is enabled, attacker could retrieve victim´s token to restore the account to the new email set on his account. This affects integrity, security and confidentiality of the application.

Screenshot from the admin dashboard with the users information, notice the Victim´s email:

Impact

An low privileged user, could modify other users (or administrators) associated emails to their accounts. If authentication is being made with email, victims won´t be able to login to their accounts. If "forgot password" is enabled, an attacker will be able to manipulate victim email and retrieve a token to modify the password having total control of the victim account. This vulnerabilty (IDOR) allows an attacker to manipulate other users email.