CVE-2023-46727 (published 2023-12-13T19:15Z)

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Johan Cwiklinski
author_date: 2023-12-13 08:18:40+01:00
msg: Merge pull request from GHSA-v799-2mp3-wgfr

Add test cases
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: RuleImportAsset.php
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,8 @@
  * ---------------------------------------------------------------------
  */
 
+use Glpi\Toolbox\Sanitizer;
+
 class RuleImportAsset extends Rule
 {
     const RULE_ACTION_LINK_OR_IMPORT    = 0;
@@ -518,7 +520,7 @@ class RuleImportAsset extends Rule
                 $this->handleOneJoinPerCriteria($item, $it_criteria);
             }
 
-            $this->handleFieldsCriteria($item, $it_criteria, $input);
+            $this->handleFieldsCriteria($item, $it_criteria, Sanitizer::sanitize($input));
 
             if (isset($PLUGIN_HOOKS['use_rules'])) {
                 foreach ($PLUGIN_HOOKS['use_rules'] as $plugin => $val) {

programming_language: PHP
filename: Bios.php
change_type: ModificationType.MODIFY
diff: @@ -144,7 +144,7 @@ class Bios extends AbstractInventoryAsset
       <NAME>pc002</NAME>
     </HARDWARE>
     <BIOS>
-      <SSN>ggheb7ne7</SSN>
+      <SSN>ggheb7'ne7</SSN>
       <BMANUFACTURER>Dell Inc.</BMANUFACTURER>
       <BVERSION>1.4.3</BVERSION>
       <MMANUFACTURER>Dell Inc.</MMANUFACTURER>
@@ -175,7 +175,7 @@ class Bios extends AbstractInventoryAsset
         //create manually a computer, with a bios
         $computers_id = $computer->add([
             'name'   => 'pc002',
-            'serial' => 'ggheb7ne7',
+            'serial' => addslashes("ggheb7'ne7"),
             'entities_id' => 0
         ]);
         $this->integer($computers_id)->isGreaterThan(0);
@@ -219,7 +219,7 @@ class Bios extends AbstractInventoryAsset
       <NAME>pc002</NAME>
     </HARDWARE>
     <BIOS>
-      <SSN>ggheb7ne7</SSN>
+      <SSN>ggheb7'ne7</SSN>
       <BMANUFACTURER>Dell Inc.</BMANUFACTURER>
       <BVERSION>1.4.4</BVERSION>
       <MMANUFACTURER>Dell Inc.</MMANUFACTURER>

programming_language: PHP
filename: Inventory.php
change_type: ModificationType.MODIFY
diff: @@ -4901,6 +4901,45 @@ Compiled Tue 28-Sep-10 13:44 by prod_rel_team",
         $this->boolean($database->getFromDBByCrit(['name' => 'MariaDB']))->isTrue();
         $this->string($database->fields['version'])->isIdenticalTo('Ver 15.1 Distrib 10.5.10-MariaDB-modified');
 
+        //- ensure existing instances has been updated
+        $databases = $database->getDatabases();
+        $this->array($databases)->hasSize(2);
+        $this->array(array_pop($databases))
+            ->string['name']->isIdenticalTo('new_database')
+            ->integer['size']->isIdenticalTo(2048);
+        $this->array(array_pop($databases))
+            ->string['name']->isIdenticalTo('glpi')
+            ->integer['size']->isIdenticalTo(55000);
+
+        //test sql syntax error
+        $json = json_decode(file_get_contents(self::INV_FIXTURES . 'computer_2_partial_dbs.json'));
+        $mysql = $json->content->databases_services[0];
+        //update version
+        $mysql->name = "Maria'DB";
+        $dbs = $mysql->databases;
+
+        $db_glpi = &$dbs[0];
+        $db_glpi->size = 55000;
+        $db_glpi->last_backup_date = '2021-06-25 08:52:44';
+
+        $db_new = &$dbs[1];
+        $db_new->name = 'new_database';
+        $db_new->size = 2048;
+
+        $services = [$mysql];
+        $json->content->databases_services = $services;
+
+        $this->doInventory($json);
+
+        //check created databases & instances
+        $this->integer(countElementsInTable(\DatabaseInstance::getTable(), ['is_deleted' => 0]))->isIdenticalTo(1);
+        $this->integer(countElementsInTable(\DatabaseInstance::getTable(), ['is_deleted' => 1]))->isIdenticalTo(2);
+
+        //ensure database version has been updated
+        $database = new \DatabaseInstance();
+        $this->boolean($database->getFromDBByCrit(['name' => 'MariaDB']))->isTrue();
+        $this->string($database->fields['version'])->isIdenticalTo('Ver 15.1 Distrib 10.5.10-MariaDB-modified');
+
         //- ensure existing instances has been updated
         $databases = $database->getDatabases();
         $this->array($databases)->hasSize(2);

programming_language: PHP