GLPI - RCE (CVE-2022-35914)

CVE-2022-35914 is a vulnerability in the htmLawed module for GLPI that enables PHP code injection through direct access to a test script within the application’s vendor directory.

CrowdSec has been tracking this vulnerability and its exploits since 7th of October 2022.

CrowdSec network data shows that most actors exploiting CVE-2022-35914 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2022-35914. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed exploitation attempts focus on requests to URLs containing /vendor/htmlawed/htmlawed/htmLawedTest.php.