# CVE-2022-35914: GLPI - RCE

> Live exploitation tracking for CVE-2022-35914 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-35914

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** GLPI
- **Weaknesses:** CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
- **Tags:** enterprise_software

## Description

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

## CrowdSec analysis

[CVE-2022-35914](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-35914) is a vulnerability in the htmLawed module for GLPI that enables PHP code injection through direct access to a test script within the application’s vendor directory.

CrowdSec has been tracking this vulnerability and its exploits since 7th of October 2022.

CrowdSec network data shows that most actors exploiting CVE-2022-35914 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2022-35914. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed exploitation attempts focus on requests to URLs containing `/vendor/htmlawed/htmlawed/htmLawedTest.php`.

## Timeline

- 2022-09-19: CVE Published. CVE-2022-35914 is published to NVD.
- 2022-10-07: Rule Released. CrowdSec releases a rule to detect CVE-2022-35914 exploitation attempts against the CrowdSec Network.
- 2022-10-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-35914 for the first time.
- 2023-03-07: CISA KEV. CVE-2022-35914 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2023-03-28: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/glpi-project/glpi/releases
- https://glpi-project.org/fr/glpi-10-0-3-disponible/
- https://github.com/Orange-Cyberdefense/CVE-repository/
- https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh
- https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35914.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-35914) follows observed exploitation activity for CVE-2022-35914. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.