CVE-2023-34254 Remote inventory task command injection when using ssh command mode
A malicious remote user can inject commands into the GLPI Agent's SSH inventory workflow, potentially gaining high privileges and disclosing credentials.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-34254?
CVE-2023-34254 is a high-severity command injection vulnerability in glpi-project glpi-agent, published on 23 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the agent is configured with for remoteinventory task. This vulnerability has been patched in glpi-agent 1.5.
Weakness: CWE-78
Which versions are affected by CVE-2023-34254?
It affects 1 product.
Products include Glpi-Project Glpi Agent.
How do I fix CVE-2023-34254?
No fix has been published for CVE-2023-34254 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-34254 being exploited?
There is no known exploitation of CVE-2023-34254 in the wild and no public exploit code.
Other vulnerabilities in glpi-project glpi-agent
Sources
Also known as GHSA-39vc-hxgm-j465, UBUNTU-CVE-2023-34254.