# CVE-2022-28108: Selenium Server (Grid) - Improper Access Control

> Live exploitation tracking for CVE-2022-28108 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-28108

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Selenium Server (Grid)
- **Weaknesses:** CWE-352 (Cross-Site Request Forgery (CSRF))
- **Tags:** web_application

## Description

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

## CrowdSec analysis

[CVE-2022-28108](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-28108) is a cross-site request forgery (CSRF) vulnerability in Selenium Server (Grid) versions before 4, caused by accepting non-JSON content types such as form data and plain text. An attacker may trick an authenticated user into submitting a crafted request, potentially compromising the confidentiality, integrity, and availability of the affected server.

CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-28108 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target Selenium Grid instances by posting crafted session-creation requests to `/wd/hub/session`. The request injects commands through Chrome capabilities, potentially enabling remote code execution by the Grid process.

## Timeline

- 2022-04-19: CVE Published. CVE-2022-28108 is published to NVD.
- 2026-10-20: Rule Released. CrowdSec releases a rule to detect CVE-2022-28108 exploitation attempts against the CrowdSec Network.

## References

- https://www.selenium.dev/downloads/
- https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/
- https://www.openwall.com/lists/oss-security/2022/02/07/3
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28108.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-28108) follows observed exploitation activity for CVE-2022-28108. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.