CVE-2021-43779: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.9
Published: 2022-01-05T19:15Z
Repository: https://github.com/pluginsGLPI/addressing
Language: PHP
Files changed: ajax/addressing.php, ajax/ping.php, front/reserveip.form.php
Commit date: 2021-11-24 11:50:03 +0100
Commit message: fix Remote Command Execution vulnerability

Diff: diff --git a/ajax/addressing.php b/ajax/addressing.php
index a9a449d..c05b2d3 100644
--- a/ajax/addressing.php
+++ b/ajax/addressing.php
@@ -57,8 +57,11 @@ if (isset($_POST['action']) && $_POST['action'] == 'viewFilter') {
                            'entity' => $_POST['entities_id']]);
 
 } else {
    Html::popHeader(__s('IP reservation', 'addressing'), $_SERVER['PHP_SELF']);
    $PluginAddressingReserveip = new PluginAddressingReserveip();
-   $PluginAddressingReserveip->showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']);
+   if(filter_var($_GET["ip"], FILTER_VALIDATE_IP)) {
+      $PluginAddressingReserveip->showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']);
+   }
+
    Html::popFooter();
 }
diff --git a/ajax/ping.php b/ajax/ping.php
index 0493b8f..6d308b7 100644
--- a/ajax/ping.php
+++ b/ajax/ping.php
@@ -38,11 +38,11 @@ include('../../../inc/includes.php');
 header("Content-Type: text/html; charset=UTF-8");
 Html::header_nocache();
 
 Session::checkLoginUser();
 
-if (!isset($_POST['ip'])) {
+if (!isset($_POST['ip']) || !filter_var($_POST["ip"], FILTER_VALIDATE_IP)) {
    exit();
 }
 $ip = $_POST['ip'];
 $itemtype = $_POST['itemtype'];
 $items_id = $_POST['items_id'];
diff --git a/front/reserveip.form.php b/front/reserveip.form.php
index 1c171b9..0317bae 100644
--- a/front/reserveip.form.php
+++ b/front/reserveip.form.php
@@ -35,8 +35,10 @@ if (isset($_POST['add'])) {
    $reserveip->check(-1, CREATE, $_POST);
    $reserveip->reserveip($_POST);
    Html::back();
 } else {
    Html::header(PluginAddressingReserveip::getTypeName(), '', "tools", "pluginaddressingmenu");
-   $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);
+   if(filter_var($_REQUEST["ip"], FILTER_VALIDATE_IP)) {
+      $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);
+   }
    Html::footer();
 }

Vulnerable code:    $PluginAddressingReserveip->showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']);
if (!isset($_POST['ip'])) {
   $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);
Fixed code:    if(filter_var($_GET["ip"], FILTER_VALIDATE_IP)) {
      $PluginAddressingReserveip->showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']);
   }

if (!isset($_POST['ip']) || !filter_var($_POST["ip"], FILTER_VALIDATE_IP)) {
   if(filter_var($_REQUEST["ip"], FILTER_VALIDATE_IP)) {
      $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);
   }