CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
Description
CVE-2022-35914 is a critical code injection vulnerability in the htmlawed module used by GLPI (Gestionnaire Libre de Parc Informatique) through version 10.0.2. The flaw exists in the htmLawedTest.php test script bundled with the htmlawed library, which allows an unauthenticated remote attacker to inject and execute arbitrary PHP code on the server. With a CVSS v3.1 score of 9.8 (Critical severity) and an EPSS score of 94.4% (99.97th percentile), CVE-2022-35914 poses an extreme risk to organizations running affected versions of GLPI. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| glpi-project | glpi | <= 10.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed(Patch, Third Party Advisory)
- https://github.com/Orange-Cyberdefense/CVE-repository/(Third Party Advisory)
- https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh(Exploit)
- https://github.com/glpi-project/glpi/releases(Release Notes, Third Party Advisory)
- https://glpi-project.org/fr/glpi-10-0-3-disponible/(Release Notes, Vendor Advisory)
- https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914(US Government Resource)
Weakness Type
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 describes a weakness where software constructs output using externally influenced input without properly neutralizing special elements that could be interpreted as control instructions by a downstream component. In CVE-2022-35914, the htmLawedTest.php script in the htmlawed module for GLPI fails to properly sanitize input before passing it to PHP evaluation functions, enabling an attacker to inject arbitrary PHP code that is executed on the server.
Learn more: CWE-74 — Injection
Impact Analysis
CVE-2022-35914 carries a CVSS v3.1 score of 9.8 (Critical severity), the highest tier, reflecting the trivial exploitation requirements and devastating impact. Attack Vector (Network): The vulnerability is exploitable remotely over the network by accessing the exposed htmLawedTest.php script, which is reachable through the web server serving GLPI. Attack Complexity (Low): No special conditions, timing, or preparation are needed to exploit this flaw. Privileges Required (None): No authentication whatsoever is required, meaning any internet-facing GLPI installation with the vulnerable script accessible is an immediate target. User Interaction (None): No action from any user is needed to trigger the exploit. Confidentiality Impact (High): Successful exploitation grants the attacker the ability to read any data accessible to the web server process, including GLPI's database credentials and asset inventory. Integrity Impact (High): The attacker can modify files, inject backdoors, and alter GLPI data. Availability Impact (High): The attacker can disrupt or destroy the GLPI service and underlying server. The EPSS score of 94.4% (99.97th percentile) confirms near-certain exploitation, making CVE-2022-35914 one of the most actively exploited vulnerabilities in GLPI's history.
Exploit Maturity
Public exploit code is widely available for CVE-2022-35914. Multiple proof-of-concept exploits have been published, including a shell script on the Orange Cyberdefense CVE repository, a detailed technical analysis by the security researcher Mayfly277, and an exploit on Packet Storm Security demonstrating command injection through the GLPI htmlawed module. CISA has confirmed active exploitation in the wild by adding CVE-2022-35914 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023. The EPSS score of 94.4% (99.97th percentile) reflects the extremely high exploitation probability. The combination of unauthenticated access, trivial exploitation, and widely available exploit code makes this GLPI vulnerability an immediate priority for remediation.
Remediation
- Upgrade GLPI to version 10.0.3 or later immediately. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. GLPI 10.0.3 addresses CVE-2022-35914 by removing or restricting access to the vulnerable htmLawedTest.php script.
- Remove or restrict access to the htmLawedTest.php file. As an immediate mitigation before upgrading, delete the file at /vendor/htmlawed/htmlawed/htmLawedTest.php from your GLPI installation, or block access to it via web server configuration rules (e.g., deny access to vendor directories).
- Block direct web access to the vendor directory. Configure your web server to deny HTTP access to the entire /vendor/ directory, which should not be publicly accessible in any case. This prevents exploitation of this and similar vulnerabilities in third-party libraries.
- Audit the affected server for indicators of compromise. Check web server access logs for requests to htmLawedTest.php, review the file system for newly created or modified PHP files (webshells), and inspect the GLPI database for unauthorized changes.
- Implement web application firewall (WAF) rules. Deploy WAF rules that block requests containing PHP code injection patterns targeting the htmLawedTest.php endpoint as an additional defense layer while patching is completed.
Technical Details
CVE-2022-35914 targets the htmLawedTest.php test script that is bundled with the htmlawed library, a PHP HTML filter and sanitizer used by GLPI. This test script was intended for development and testing purposes but was inadvertently included in production deployments of GLPI through version 10.0.2. Injection Mechanism: The htmLawedTest.php script accepts user input through HTTP POST parameters and passes it to PHP functions without adequate sanitization. An attacker can craft a POST request that injects arbitrary PHP code, which is then evaluated and executed by the server. No Authentication Required: The script is accessible at the path /vendor/htmlawed/htmlawed/htmLawedTest.php without any authentication or access control, meaning anyone who can reach the GLPI web server can exploit this vulnerability. Execution Context: The injected PHP code executes with the privileges of the web server process (typically www-data or apache), granting the attacker the ability to read the GLPI configuration (including database credentials), access the underlying database, write files to the web root, and potentially escalate privileges on the hosting system. The critical nature of this vulnerability stems from the combination of zero-authentication access, trivial exploitation, and the sensitive nature of data typically managed by GLPI IT asset management deployments.
Frequently Asked Questions
Is CVE-2022-35914 being actively exploited?
Yes, CVE-2022-35914 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023. Multiple public exploits are available, and the EPSS score of 94.4% (99.97th percentile) confirms near-certain exploitation activity targeting GLPI installations.
What products are affected by CVE-2022-35914?
CVE-2022-35914 affects GLPI (Gestionnaire Libre de Parc Informatique) through version 10.0.2. The vulnerability is specifically in the htmLawedTest.php test script of the htmlawed module, a third-party PHP library bundled with GLPI. Any GLPI installation where this script is web-accessible is vulnerable.
How do I fix CVE-2022-35914?
Upgrade GLPI to version 10.0.3 or later. As an immediate mitigation, delete or block access to the /vendor/htmlawed/htmlawed/htmLawedTest.php file and deny HTTP access to the entire /vendor/ directory. Audit server logs for prior exploitation attempts. See the Remediation section for detailed steps.
How severe is CVE-2022-35914?
CVE-2022-35914 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It requires no authentication, no user interaction, and has low attack complexity, while resulting in full compromise of confidentiality, integrity, and availability. The EPSS score of 94.4% (99.97th percentile) indicates near-certain exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.