{"id":"TECH-202610-glpi-agent-remote-code-execution-via-rogue-glpi-server-using","kind":"technique","aliases":[],"related":[],"title":"GLPI Agent remote code execution via rogue GLPI server using an AD CS ESC17 certificate (public tool GLPwnIou)","description":null,"summary":"Fenrisk research (2026-10-20) with a newly public tool, GLPwnIou. GLPI Agent before 1.8, and agents upgraded from before 1.8, ask the server for inventory/deploy tasks by default and run them as SYSTEM/root, even when the server does not use deploy. Before, HTTPS with certificate checking stopped a fake server. With an ESC17-vulnerable AD CS template (Server Authentication EKU plus Enrollee Supplies Subject), an attacker in the domain can get a valid certificate for the GLPI server's name. They then put themselves in the middle (mitm6, ARP spoofing, or a stale or editable DNS record) and push commands or binaries to every agent that connects. At risk: Active Directory environments running GLPI Agent with a misconfigured AD CS. Proof of concept and pentest tool; no in-the-wild use reported.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GLPI Agent","fixed":[],"vendor":"GLPI Project"},{"name":"GLPI","fixed":[],"vendor":"Teclib"},{"name":"Active Directory Certificate Services","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"GLPI Agent version below 1.8, or installed before 1.8 and later upgraded, with the deploy task active; AD CS templates allowing Server Authentication plus Enrollee Supplies Subject to low-privileged users; CA events 4886/4887 for the GLPI server name from an unexpected requester; glpi-agent spawning cmd.exe/powershell or writing C:\\Windows\\Temp\\pwned.fenrisk; deploy responses with ID 0fae2958-24d5-0651-c49c-d1fec1766af6 and no usual GLPI/PHP headers","fix":"Lock down AD CS Server Authentication templates (limit who can enroll, remove Enrollee Supplies Subject) and audit certificate requests; turn off the deploy task on agents that do not need it (agents upgraded from before 1.8 keep it on); enforce HTTPS with strict checking or pinning to the GLPI server certificate; disable IPv6 where unused to block mitm6, and watch DNS changes for the GLPI host","status":"open","published_at":null,"first_seen_at":"2026-10-27T15:07:24+00:00","triaged_at":"2026-10-27T15:07:24+00:00","updated_at":"2026-10-27T15:07:24+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':46B '-20':47B '-202610':20A '1.8':57B,63B '2026':45B 'activ':154B 'active':35A 'ad':12A,99B,163B 'agent':2A,23A,33A,55B,59B,149B,159B 'arp':133B 'ask':64B 'attack':110B 'authent':103B 'binari':146B 'certif':15A,88B,118B 'certificate':37A 'check':89B 'code':4A,25A 'command':144B 'concept':167B 'connect':151B 'cs':13A,100B,164B 'default':71B 'deploy':84B 'directori':155B 'directory':36A 'dns':140B 'domain':113B 'earli':40B 'early-warn':39B 'edit':139B 'eku':104B 'enrolle':106B 'environ':156B 'esc17':14A,97B 'esc17-vulnerable':96B 'even':77B 'everi':148B 'execut':5A 'execution':26A 'fake':92B 'fenrisk':43B 'get':115B 'glpi':1A,8A,22A,29A,32A,34A,54B,121B,158B 'glpi-agent-remote-code-execution-via-rogue-glpi-server-using':21A 'glpwniou':18A,53B 'https':86B 'in-the-wild':172B 'inventory/deploy':68B 'middl':131B 'misconfigur':162B 'mitm6':132B 'name':124B 'newli':50B 'pentest':169B 'plus':105B 'proof':165B 'public':16A,51B 'push':143B 'put':127B 'record':141B 'remot':3A 'remote':24A 'report':177B 'research':44B 'risk':153B 'rogu':7A 'rogue':28A 'run':73B,157B 'server':9A,30A,66B,80B,93B,102B,122B 'services':38A 'spoof':134B 'stale':137B 'stop':90B 'subject':108B 'suppli':107B 'system/root':76B 'task':69B 'tech':19A 'techniqu':42B 'templat':101B 'tool':17A,52B,170B 'upgrad':60B 'use':10A,83B,176B 'using':31A 'valid':117B 'via':6A,27A 'vulner':98B 'warn':41B 'wild':175B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:06:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-glpi-agent-remote-code-execution-via-rogue-glpi-server-using","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-27T15:07:24+00:00","fetched_at":"2026-10-27T15:07:24+00:00","note":null}],"documents":[{"id":6710,"url":"https://t.co/NugPx5B6G2","title":"Reviving GLPI Agent Abuse with ESC17 · Fenrisk","kind":"blog","source":"analyst","text":"Fenrisk research: GLPI Agent < 1.8 (and agents upgraded from < 1.8) poll for inventory/deploy tasks by default and run them as SYSTEM/root. With an ESC17-vulnerable AD CS template (Server Authentication EKU + Enrollee Supplies Subject), an attacker requests a valid cert for the GLPI server FQDN, gets a MitM position (mitm6, ARP spoofing, stale/editable DNS) and serves malicious deploy tasks with the public tool GLPwnIou (github.com/FenriskSecurity/glpwniou), defeating HTTPS+cert checking. IoCs: CA events 4886/4887 for GLPI FQDN by unexpected enrollee; GLPI-Agent spawning cmd.exe/powershell; C:\\Windows\\Temp\\pwned.fenrisk; tool hardcoded ID 0fae2958-24d5-0651-c49c-d1fec1766af6 in responses lacking GLPI headers. Fix: restrict Server Auth templates / remove Enrollee Supplies Subject; disable unused deploy on agents; pin certs; segment.","published_at":"2026-10-20T15:06:40+00:00","relation":"describes","confidence":null,"note":null},{"id":6630,"url":"https://x.com/_r_netsec/status/2115089475785424978","title":"@_r_netsec: Reviving GLPI Agent Abuse with ESC17 https://t.co/NugPx5B6G2","kind":"post","source":"x","text":"Reviving GLPI Agent Abuse with ESC17 https://t.co/NugPx5B6G2\n\nlikes 0 reposts 0","published_at":"2026-10-27T14:33:22+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}