GLPI Directory Listing

What is the "GLPI Directory Listing?"

The "GLPI Directory Listing" module is designed to detect misconfigurations in the GLPI software. GLPI is a popular IT asset management and service desk software used by organizations to manage their IT infrastructure. This module focuses on identifying instances where system administrators have left directory listing enabled, which can potentially expose sensitive files.

This module has a low severity level, indicating that the impact of the misconfiguration is relatively limited. However, it is still important to address this issue to prevent any potential data leaks or unauthorized access to sensitive information.

This module was authored by RedTeamBrasil and ImNightmaree.

Impact

If the GLPI directory listing is enabled, it can expose the contents of directories and files within the GLPI installation. This can potentially lead to the disclosure of sensitive information, such as configuration files, database backups, or other files that should not be publicly accessible. Attackers could exploit this vulnerability to gain unauthorized access to sensitive data or gather information for further attacks.

How does the module work?

The "GLPI Directory Listing" module works by sending an HTTP request to the target GLPI installation and checking for specific conditions that indicate the presence of directory listing. The module uses the following matching conditions:

- Body: The module looks for the presence of the phrase "Index of /glpi/" in the response body, indicating that directory listing is enabled. - Status: The module checks if the HTTP response status code is 200, indicating a successful request.

Here is an example of an HTTP request sent by the module:

GET /glpi/files/ HTTP/1.1
Host: [Hostname]

The module sends this request to the target GLPI installation, replacing [Hostname] with the actual hostname of the target. If the response meets the matching conditions, the module reports a vulnerability.

It is important to note that this module is just one test case within the Vidoc platform, which utilizes multiple modules to perform comprehensive scanning and detection of various misconfigurations, vulnerabilities, and software fingerprints.