{"id":"CVE-2026-58256","published":"2026-10-27T23:17:06.140","lastModified":"2026-10-27T23:17:06.140","description":"GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f","tags":[]},{"url":"https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8","tags":[]},{"url":"https://github.com/JeromeDevome/GRR/tree/v4.5.0","tags":[]}],"exploitRefs":[{"url":"https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f","tags":[]},{"url":"https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8","tags":[]},{"url":"https://github.com/JeromeDevome/GRR/tree/v4.5.0","tags":[]}],"hasPoc":true,"ai":{"summary":"A PHP code injection vulnerability (CWE-94) in GRR's LDAP connector configuration allows an authenticated administrator to inject malicious PHP code via parameters like `ldap_filter`, which gets written to `config_ldap.inc.php` and enables remote code execution.","exploitability":"Exploitation requires an attacker who already has administrator privileges, can connect to a (possibly attacker-controlled) LDAP server, and submits malicious input on the connector settings page after successful LDAP bind.","blast_radius":"Successful exploitation grants full remote code execution with the privileges of the web application, compromising confidentiality, integrity, and availability of the affected system.","remediation":"Upgrade to GRR version 4.5.0 or later, where the vulnerability is fixed.","detection":"Defenders may observe anomalous writes to `/personnalisation/config_ldap.inc.php` containing PHP code (e.g., `<?php`, `eval(`, `system(`) in file system logs or web application audit logs; additionally, unexpected outbound LDAP connections to untrusted or newly configured servers may be visible in network logs.","tags":["rce","php-injection","ldap","admin-privilege","webapp"],"model":"garnet-coder","analyzedAt":"2026-10-28T10:04:17.776Z"}}