CVE-2020-11034: 
GLPI vulnerability analysis and mitigation

In GLPI versions prior to 9.4.6, a vulnerability was discovered that allowed attackers to bypass the open redirect protection mechanism. The vulnerability (CVE-2020-11034) was disclosed on May 5, 2020, affecting the GLPI IT asset management software. The issue stemmed from an inadequate regular expression-based protection system (GitHub Advisory).

The vulnerability exists in the manageRedirect function within glpi/inc/toolbox.class.php. The protection mechanism, which was based on a regular expression, could be bypassed by using a specific URL pattern such as 'http://HOST/index.php?redirect=/\/example.com'. When processed, this URL would be rewritten to '//example.com', which would then redirect to example.com. This bypass was confirmed to work on both Chrome and Firefox browsers. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows attackers to bypass the open redirect protection, potentially enabling them to redirect users to malicious websites. This could be exploited in phishing attacks or other social engineering attempts where users might trust the initial GLPI URL but end up on an attacker-controlled site (GitHub Advisory).

The vulnerability requires no special privileges to exploit and can be triggered through a specially crafted URL. The attack requires user interaction, as the victim needs to follow the malicious redirect link. The vulnerability was confirmed to be exploitable on major browsers including Chrome and Firefox (GitHub Advisory).

The vulnerability was fixed in GLPI version 9.4.6. Organizations using affected versions should upgrade to version 9.4.6 or later. The fix was implemented in commit 5a74983 (GitHub Advisory, Fedora Update).