Skip to content

LDAP password exposed on source code

Low
trasher published GHSA-4r49-52q9-5fgr Apr 21, 2022

Package

GLPI (glpi)

Affected versions

< 10.0.0

Patched versions

10.0.0

Description

When you pass the config to the javascript, some entries are filtered
out. The variable ldap_pass is not filtered and when you look at the
source code of the page, we can see the password for the root dn

If I understand correctly, when the footer is loaded1, the js variable
CFG_GLPI is populated2 with some of the variables filtered out3

Problem is, the ldap_pass is not filtered and when I check the page's
source, I can see all the ldap informations :

[...]"ldap_host":"REDACTED","ldap_basedn":"REDACTED","ldap_rootdn":"REDACTED","ldap_pass":"REDACTED"[...]

(of course, the informations are in plaintext)

For the record, I join the dump of my GLPI setup information.

GLPI 9.5.5 ( => /var/www/intervs)
Installation mode: TARBALL

Server

 
Operating system: Linux serv-intervs 4.19.0-17-amd64 #1 SMP Debian 4.19.194-3 (2021-07-18) x86_64
PHP 7.3.29-1~deb10u1 fpm-fcgi (Core, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apc, apcu, bz2, calendar, cgi-fcgi,
	ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imap, intl, json, ldap, libxml, mbstring, mysqli,
	mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm,
	tokenizer, wddx, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib)
Setup: max_execution_time="30" memory_limit="128M" post_max_size="8M" safe_mode="" session.save_handler="files"
	upload_max_filesize="2M" 
Software: Apache ()
	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0
Server Software: Debian 10
	Server Version: 10.3.29-MariaDB-0+deb10u1
	Server SQL Mode: 
	Parameters: glpi@localhost/glpi
	Host info: Localhost via UNIX socket
	
PHP version is at least 7.2.0 - Perfect!PHP version is at least 7.2.0 - Perfect!
Sessions support is available - Perfect!Sessions support is available - Perfect!
Allocated memory > 64 Mio - Perfect!Allocated memory > 64 Mio - Perfect!
mysqli extension is installedmysqli extension is installed
ctype extension is installedctype extension is installed
fileinfo extension is installedfileinfo extension is installed
json extension is installedjson extension is installed
mbstring extension is installedmbstring extension is installed
iconv extension is installediconv extension is installed
zlib extension is installedzlib extension is installed
curl extension is installedcurl extension is installed
gd extension is installedgd extension is installed
simplexml extension is installedsimplexml extension is installed
intl extension is installedintl extension is installed
ldap extension is installedldap extension is installed
apcu extension is installedapcu extension is installed
Zend OPcache extension is installedZend OPcache extension is installed
xmlrpc extension is installedxmlrpc extension is installed
CAS extension is installedCAS extension is installed
exif extension is installedexif extension is installed
zip extension is installedzip extension is installed
bz2 extension is installedbz2 extension is installed
sodium extension is installedsodium extension is installed
Database version seems correct (10.3.29) - Perfect!Database version seems correct (10.3.29) - Perfect!
Timezones seems loaded in databaseTimezones seems loaded in database
The log file has been created successfully.The log file has been created successfully.
Write access to /var/www/intervs/files/_cache has been validated.Write access to /var/www/intervs/files/_cache has been validated.
Write access to /var/www/intervs/config has been validated.Write access to /var/www/intervs/config has been validated.
Write access to /var/www/intervs/files/_cron has been validated.Write access to /var/www/intervs/files/_cron has been validated.
Write access to /var/www/intervs/files has been validated.Write access to /var/www/intervs/files has been validated.
Write access to /var/www/intervs/files/_dumps has been validated.Write access to /var/www/intervs/files/_dumps has been validated.
Write access to /var/www/intervs/files/_graphs has been validated.Write access to /var/www/intervs/files/_graphs has been validated.
Write access to /var/www/intervs/files/_lock has been validated.Write access to /var/www/intervs/files/_lock has been validated.
Write access to /var/www/intervs/files/_pictures has been validated.Write access to /var/www/intervs/files/_pictures has been validated.
Write access to /var/www/intervs/files/_plugins has been validated.Write access to /var/www/intervs/files/_plugins has been validated.
Write access to /var/www/intervs/files/_rss has been validated.Write access to /var/www/intervs/files/_rss has been validated.
Write access to /var/www/intervs/files/_sessions has been validated.Write access to /var/www/intervs/files/_sessions has been validated.
Write access to /var/www/intervs/files/_tmp has been validated.Write access to /var/www/intervs/files/_tmp has been validated.
Write access to /var/www/intervs/files/_uploads has been validated.Write access to /var/www/intervs/files/_uploads has been validated.
Write access to /var/www/intervs/marketplace has been validated.Write access to /var/www/intervs/marketplace has been validated.
Web access to the files directory should not be allowed but this cannot be checked automatically on this instance. Make sure access to error log file (/files/_log/php-errors.log) is forbidden; otherwise review .htaccess file and web server configuration.Web access to the files directory should not be allowed but this cannot be checked automatically on this instance.
Make sure access to error log file (/files/_log/php-errors.log) is forbidden; otherwise review .htaccess file and web server configuration.

GLPI constants

 
GLPI_ROOT: /var/www/intervs
GLPI_CONFIG_DIR: /var/www/intervs/config
GLPI_VAR_DIR: /var/www/intervs/files
GLPI_MARKETPLACE_DIR: /var/www/intervs/marketplace
GLPI_USE_CSRF_CHECK: 1
GLPI_CSRF_EXPIRES: 7200
GLPI_CSRF_MAX_TOKENS: 100
GLPI_USE_IDOR_CHECK: 1
GLPI_IDOR_EXPIRES: 7200
GLPI_ALLOW_IFRAME_IN_RICH_TEXT: 
GLPI_TELEMETRY_URI: https://telemetry.glpi-project.org
GLPI_INSTALL_MODE: TARBALL
GLPI_NETWORK_MAIL: glpi@teclib.com
GLPI_NETWORK_SERVICES: https://services.glpi-network.com
GLPI_MARKETPLACE_PRERELEASES: 
GLPI_MARKETPLACE_ALLOW_OVERRIDE: 1
GLPI_MARKETPLACE_MANUAL_DOWNLOADS: 1
GLPI_USER_AGENT_EXTRA_COMMENTS: 
GLPI_AJAX_DASHBOARD: 1
GLPI_CALDAV_IMPORT_STATE: 0
GLPI_DEMO_MODE: 0
GLPI_FORCE_EMPTY_SQL_MODE: 1
GLPI_DOC_DIR: /var/www/intervs/files
GLPI_CACHE_DIR: /var/www/intervs/files/_cache
GLPI_CRON_DIR: /var/www/intervs/files/_cron
GLPI_DUMP_DIR: /var/www/intervs/files/_dumps
GLPI_GRAPH_DIR: /var/www/intervs/files/_graphs
GLPI_LOCAL_I18N_DIR: /var/www/intervs/files/_locales
GLPI_LOCK_DIR: /var/www/intervs/files/_lock
GLPI_LOG_DIR: /var/www/intervs/files/_log
GLPI_PICTURE_DIR: /var/www/intervs/files/_pictures
GLPI_PLUGIN_DOC_DIR: /var/www/intervs/files/_plugins
GLPI_RSS_DIR: /var/www/intervs/files/_rss
GLPI_SESSION_DIR: /var/www/intervs/files/_sessions
GLPI_TMP_DIR: /var/www/intervs/files/_tmp
GLPI_UPLOAD_DIR: /var/www/intervs/files/_uploads
GLPI_NETWORK_REGISTRATION_API_URL: https://services.glpi-network.com/api/registration/
GLPI_MARKETPLACE_PLUGINS_API_URI: https://services.glpi-network.com/api/glpi-plugins/
GLPI_I18N_DIR: /var/www/intervs/locales
GLPI_VERSION: 9.5.5
GLPI_SCHEMA_VERSION: 9.5.5
GLPI_MIN_PHP: 7.2.0
GLPI_YEAR: 2021

Libraries

 
htmlawed/htmlawed version 1.2.5 in (/var/www/intervs/vendor/htmlawed/htmlawed)
phpmailer/phpmailer version 6.1.6 in (/var/www/intervs/vendor/phpmailer/phpmailer/src)
simplepie/simplepie version 1.5.6 in (/var/www/intervs/vendor/simplepie/simplepie/library)
tecnickcom/tcpdf version 6.3.5 in (/var/www/intervs/vendor/tecnickcom/tcpdf)
michelf/php-markdown in (/var/www/intervs/vendor/michelf/php-markdown/Michelf)
true/punycode in (/var/www/intervs/vendor/true/punycode/src)
iamcal/lib_autolink in (/var/www/intervs/vendor/iamcal/lib_autolink)
sabre/dav in (/var/www/intervs/vendor/sabre/dav/lib/DAV)
sabre/http in (/var/www/intervs/vendor/sabre/http/lib)
sabre/uri in (/var/www/intervs/vendor/sabre/uri/lib)
sabre/vobject in (/var/www/intervs/vendor/sabre/vobject/lib)
laminas/laminas-cache in (/var/www/intervs/vendor/laminas/laminas-cache/src)
laminas/laminas-i18n in (/var/www/intervs/vendor/laminas/laminas-i18n/src)
laminas/laminas-serializer in (/var/www/intervs/vendor/laminas/laminas-serializer/src)
monolog/monolog in (/var/www/intervs/vendor/monolog/monolog/src/Monolog)
sebastian/diff in (/var/www/intervs/vendor/sebastian/diff/src)
elvanto/litemoji in (/var/www/intervs/vendor/elvanto/litemoji/src)
symfony/console in (/var/www/intervs/vendor/symfony/console)
scssphp/scssphp in (/var/www/intervs/vendor/scssphp/scssphp/src)
laminas/laminas-mail in (/var/www/intervs/vendor/laminas/laminas-mail/src/Protocol)
laminas/laminas-mime in (/var/www/intervs/vendor/laminas/laminas-mime/src)
rlanvin/php-rrule in (/var/www/intervs/vendor/rlanvin/php-rrule/src)
blueimp/jquery-file-upload in (/var/www/intervs/vendor/blueimp/jquery-file-upload/server/php)
ramsey/uuid in (/var/www/intervs/vendor/ramsey/uuid/src)
psr/log in (/var/www/intervs/vendor/psr/log/Psr/Log)
psr/simple-cache in (/var/www/intervs/vendor/psr/simple-cache/src)
mexitek/phpcolors in (/var/www/intervs/vendor/mexitek/phpcolors/src/Mexitek/PHPColors)
guzzlehttp/guzzle in (/var/www/intervs/vendor/guzzlehttp/guzzle/src)
guzzlehttp/psr7 in (/var/www/intervs/vendor/guzzlehttp/psr7/src)
wapmorgan/unified-archive in (/var/www/intervs/vendor/wapmorgan/unified-archive/src)
paragonie/sodium_compat in (/var/www/intervs/vendor/paragonie/sodium_compat/src)
phpCas version 1.3.6 in (/usr/share/php/CAS/source)

LDAP directories

 
Server: '10.5.0.2', Port: '389', BaseDN: 'ou=REDACTED,dc=REDACTED,dc=fr', Connection filter:
		'(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))', RootDN: 'CN= REDACTED,OU=REDACTED,OU=REDACTED,OU=REDACTED,DC=REDACTED,DC=fr', Use TLS: none

SQL replicas

 
Not active

Notifications

 
Way of sending emails: SMTP (anonymous@10.5.212.129)

Mails receivers

 

Plugins list

 
	compte               Name:                                Version: 1.4        State: Error / to clean
	immo                 Name:                                Version: 1.1        State: Error / to clean
	manageentity         Name:                                Version: 1.4        State: Error / to clean
	ticketreport         Name:                                Version: 1.1        State: Error / to clean
	treeview             Name:                                Version: 1.1        State: Error / to clean
	archires             Name: Architectures réseau           Version: 2.4.0      State: Error / to clean
	behaviors            Name: Comportements                  Version: 2.5.0      State: Enabled
	formcreator          Name: Form Creator                   Version: 2.12.0     State: Enabled
	genericobject        Name: Gestion d'objets               Version: 2.11.0     State: Enabled
	order                Name: Gestion des commandes          Version: 2.7.0      State: Enabled
	pdf                  Name: Impression pdf                 Version: 2.0.0      State: Enabled
	ocsinventoryng       Name: OCS Inventory NG               Version: 1.7.3      State: Enabled
	reports              Name: Rapports                       Version: 1.14.1     State: Enabled
	relations            Name: Relations                      Version: 1.2.0      State: Error / to clean
	resources            Name: Ressources humaines            Version: 2.7.0      State: Enabled

OCS Inventory NG
Host: 10.5.0.10
Connection: Ok
Use the OCSNG software dictionary: No
Host: 10.5.0.10
Connection: Ok
Use the OCSNG software dictionary: No

Severity

Low

CVE ID

CVE-2022-24867

Weaknesses

No CWEs

Credits