CVE-2020-5248 PoC — Public GLPIKEY can be used to decrypt any data in GLPI

Source

https://github.com/venomnis/CVE-2020-5248

Associated Vulnerability

Title:Public GLPIKEY can be used to decrypt any data in GLPI (CVE-2020-5248)
Description:GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

Description

Proof of Concept (PoC) for CVE-2020-5248.

Readme

## CVE-2020-5248
Proof of Concept (PoC) for CVE-2020-5248.

## Summary
GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

## PoC:
Replace the "INSERT_COIN" string with the one that you would like to decrypt at https://github.com/indevi0us/CVE-2020-5248/blob/main/decrypt_any.php.

## References:
* https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9
* https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c
* https://offsec.almond.consulting/multiple-vulnerabilities-in-glpi.html

File Snapshot


 [4.0K]  /data/pocs/2c3a74111052eff3cd54c88b886f8325ca370c5b
├── [ 391]  decrypt_any.php
└── [1.0K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!