CVE-2022-35947 (published 2022-09-14T18:15Z)

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Cédric Anne
author_date: 2022-08-03 12:50:53+02:00
msg: Ensure token based authentication only accept strings
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: User.php
change_type: ModificationType.MODIFY
diff: @@ -627,6 +627,14 @@ class User extends CommonDBTM
      */
     public function getFromDBbyToken($token, $field = 'personal_token')
     {
+        if (!is_string($token)) {
+            trigger_error(
+                sprintf('Unexpected token value received: "string" expected, received "%s".', gettype($token)),
+                E_USER_WARNING
+            );
+            return false;
+        }
+
         $fields = ['personal_token', 'api_token'];
         if (!in_array($field, $fields)) {
             trigger_error(

programming_language: PHP
filename: User.php
change_type: ModificationType.MODIFY
diff: @@ -173,13 +173,22 @@ class User extends \DbTestCase
         $this->array($user2->fields)->isIdenticalTo($user->fields);
 
         $this->when(
-            function () use ($uid) {
-                $this->testedInstance->getFromDBbyToken($uid, 'my_field');
+            function () {
+                $this->testedInstance->getFromDBbyToken('1485dd60301311eda2610242ac12000249aef69a', 'my_field');
             }
         )->error
-         ->withType(E_USER_WARNING)
-         ->withMessage('User::getFromDBbyToken() can only be called with $field parameter with theses values: \'personal_token\', \'api_token\'')
-         ->exists();
+            ->withType(E_USER_WARNING)
+            ->withMessage('User::getFromDBbyToken() can only be called with $field parameter with theses values: \'personal_token\', \'api_token\'')
+            ->exists();
+
+        $this->when(
+            function () {
+                $this->testedInstance->getFromDBbyToken(['REGEX', '.*'], 'api_token');
+            }
+        )->error()
+            ->withType(E_USER_WARNING)
+            ->withMessage('Unexpected token value received: "string" expected, received "array".')
+            ->exists();
     }
 
     public function testPrepareInputForAdd()

programming_language: PHP