CVE-2024-27098 (PHP, published 2024-03-18T17:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/glpi-project/glpi
Files changed:
ajax/comments.php
ajax/dropdownLocation.php
ajax/kanban.php
ajax/rule.php
ajax/updateTranslationFields.php
ajax/updateTranslationValue.php
composer.json
front/device.php
front/devicemodel.form.php
front/devicemodel.php
front/devicetype.form.php
front/devicetype.php
front/item_device.php
front/itilfollowup.form.php
front/itilsolution.form.php
src/RuleAction.php
tests/web/APIRest.php
tools/patches/guzzle-http-client-restrict-http-methods.patch
Commit message: Merge pull request from GHSA-92x4-q9w5-837w

* Check for valid itemtype before creating objects

* Restrict HTTP methods allowed by Guzzle client

---------

Co-authored-by: Cédric Anne <cedric.anne@gmail.com>

Vulnerable code:
                    $item = new $_POST['itemtype']();
$item = new $_REQUEST['itemtype']();
    $kanban = new $_POST['kanban']['itemtype']();
            $rule_collection = new $_POST['collection_classname']();
    $item = new $_POST['itemtype']();
    $itemtype = new $_POST['itemtype']();
            "patch -f -p1 -d vendor/michelf/php-markdown/ < tools/patches/php-markdown-php8-compat.patch || true"
            "patch -f -p1 -d vendor/michelf/php-markdown/ < tools/patches/php-markdown-php8-compat.patch || true"
$dropdown = new $_GET['itemtype']();
$dropdown = new $_GET['itemtype']();
$dropdown = new $_GET['itemtype']();
$dropdown = new $_GET['itemtype']();
$dropdown = new $_GET['itemtype']();
$itemDevice = new $_GET['itemtype']();
$track = new $_POST['itemtype']();
$track = new $_POST['itemtype']();
            $rule = new $_POST['rule_class_name']();
        $verb = strtolower($verb);
        if (in_array($verb, ['get', 'post', 'delete', 'put', 'options', 'patch'])) {
            try {
                return $this->http_client->{$verb}(
                    $this->base_uri . $relative_uri,
                    $params
                );
            } catch (\Throwable $e) {
                throw $e;
            }
        }

Fixed code:
                    $item = getItemForItemtype($_POST['itemtype']);
$item = getItemForItemtype($_REQUEST['itemtype']);
    $kanban = getItemForItemtype($_POST['kanban']['itemtype']);
            $rule_collection = getItemForItemtype($_POST['collection_classname']);
    $item = getItemForItemtype($_POST['itemtype']);
    $itemtype = getItemForItemtype($_POST['itemtype']);
            "patch -f -p1 -d vendor/michelf/php-markdown/ < tools/patches/php-markdown-php8-compat.patch || true",
            "patch -f -p1 -d vendor/guzzlehttp/guzzle/ < tools/patches/guzzle-http-client-restrict-http-methods.patch || true"
            "patch -f -p1 -d vendor/michelf/php-markdown/ < tools/patches/php-markdown-php8-compat.patch || true",
            "patch -f -p1 -d vendor/guzzlehttp/guzzle/ < tools/patches/guzzle-http-client-restrict-http-methods.patch || true"
$dropdown = getItemForItemtype($_GET['itemtype']);
$dropdown = getItemForItemtype($_GET['itemtype']);
$dropdown = getItemForItemtype($_GET['itemtype']);
$dropdown = getItemForItemtype($_GET['itemtype']);
$dropdown = getItemForItemtype($_GET['itemtype']);
$itemDevice = getItemForItemtype($_GET['itemtype']);
$track = getItemForItemtype($_POST['itemtype']);
$track = getItemForItemtype($_POST['itemtype']);
            $rule = getItemForItemtype($_POST['rule_class_name']);
        return $this->http_client->request(
            $verb,
            $this->base_uri . $relative_uri,
            $params
        );
diff --git a/src/Client.php b/src/Client.php
index 58f1d891..7448bb49 100644
--- a/src/Client.php
@@ -70,28 +70,6 @@ class Client implements ClientInterface, \Psr\Http\Client\ClientInterface
         $this->configureDefaults($config);
     }
 
-    /**
-     * @param string $method
-     * @param array  $args
-     *
-     * @return PromiseInterface|ResponseInterface
-     *
-     * @deprecated Client::__call will be removed in guzzlehttp/guzzle:8.0.
-     */
-    public function __call($method, $args)
-    {
-        if (\count($args) < 1) {
-            throw new InvalidArgumentException('Magic request methods require a URI and optional options array');
-        }
-
-        $uri = $args[0];
-        $opts = $args[1] ?? [];
-
-        return \substr($method, -5) === 'Async'
-            ? $this->requestAsync(\substr($method, 0, -5), $uri, $opts)
-            : $this->request($method, $uri, $opts);
-    }
-
     /**
      * Asynchronously send an HTTP request.
      *